As cited
Copy frozen at (site build).
threat intel
FORMBOOK Adopts CAB-less Approach
Security researchers observed a FORMBOOK intrusion attempt using a new technique that eliminates the need for a command and control (C2) server intermediary. The malware campaign demonstrates an evolution in the threat actor's infrastructure approach, potentially making detection and attribution more difficult.
Why it matters: Organizations running endpoint detection and response (EDR) and network monitoring tools need to update signatures and behavioral rules, as FORMBOOK's CAB-less variant may bypass C2-based detection methods commonly used to identify this malware family.
- Source published
- First seen by Cybersecurity Tracker