Proofpoint security researchers have observed a new series of phishing attacks targeting entities in the United States utilities sector in an attempt to deliver the LookBack remote access Trojan (RAT).
In early August, the security firm detailed a series of similar attacks on the U.S. utilities sector, where phishing emails would carry Word documents containing malicious macros that were designed to download and execute the LookBack Trojan.
Now, Proofpoint says a new wave of attacks was observed between August 21 and August 29, and that additional organizations in the utilities sector were targeted. The emails impersonated a licensing body related to the utilities sector, masquerading as Global Energy Certification (GEC).
The tactics, techniques, and procedures (TTPs) are consistent with previously reported activity. Attached Word documents were once again leveraged for malware delivery.
So far, the security researchers have identified at least 17 entities in the US utilities sector that have been targeted by these threat actors from April 5 through August 29, 2019.
The researchers also discovered that the attackers conducted reconnaissance scanning against future targets utilizing a staging IP. The scanning targeted SMB over IP via port 445 for up to two weeks prior to the sending of the phishing emails.
Originating from an email address at the domain globalenergycertification[.]net, which spoofs the official GEC website, the message invited recipients to take the GEC exam administered by the Energy Research and Intelligence Institution.
In addition to the malicious Word document, the emails also had a legitimate and benign PDF file attached. Designed for exam preparation, the PDF was hosted on the legitimate GEC site.
The VBA macros in the Word document were similar to those observed in July. As soon as the user opens the attachment and enables it, the macro installs several privacy-enhanced mail (PEM) files on the host. These files are both malware modules and macro variables.
Additionally, the macro drops a version of certutil.exe on to the victim’s machine, and leverages it to decode the initial files. The PEM files are a GUP Proxy tool, a malicious loader, and a file containing command and control (C&C) configuration data.
The attackers modified the macros in the recent campaign, by adding some more variables that are referred to when the Word document is opened and macros are enabled. These variables, likely an attempt at obfuscation, are leveraged in the installation of the malicious loader. The C&C server used in this campaign was 103.253.41[.]45, the same as in the July attacks.
“The evolution of TTPs including updated macros demonstrates a further departure from tactics previously employed by known APT groups. However, at the current moment, the creators of LookBack malware are yet to depart from their persistent focus on critical infrastructure providers in the United States,” Proofpoint concludes.
Related: New “LookBack” Malware Used in Attacks Against U.S. Utilities Sector
Related: Hackers Behind ‘Triton’ Malware Target Electric Utilities in US, APAC

More from Ionut Arghire
- Critical QNAP Vulnerability Leads to Code Injection
- GitHub Revokes Code Signing Certificates Following Cyberattack
- Vulnerabilities in OpenEMR Healthcare Software Expose Patient Data
- Russia-Linked APT29 Uses New Malware in Embassy Attacks
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
Latest News
- How the Atomized Network Changed Enterprise Protection
- Critical QNAP Vulnerability Leads to Code Injection
- Saviynt Raises $205M; Founder Rejoins as CEO
- OpenVEX Spec Adds Clarity to Supply Chain Vulnerability Warnings
- GitHub Revokes Code Signing Certificates Following Cyberattack
- Russian Millionaire on Trial in Hack, Insider Trade Scheme
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Vulnerabilities in OpenEMR Healthcare Software Expose Patient Data
