BlueVoyant Cyber Defense

In an early August incident, the BlueVoyant SOC (Security Operations Center) observed Oyster Backdoor being utilized to deploy additional payloads within a client environment operating in the healthcare sector. After conducting a thorough investigation, BlueVoyant determined that an IT user downloaded a malicious installer masquerading as WinSCP which resulted in the deployment of the Oyster backdoor.

Arctic Wolf reporting indicates this new campaign began in early June and targeted IT personnel by masquerading Oyster backdoors (a.k.a. Broomstick, CleanUpLoader, CleanBoost) as installation files for legitimate IT tools WinSCP and PuTTY. BlueVoyant’s Threat Fusion Cell (TFC) confirmed this campaign and notes it is ongoing.