Cisco Talos researchers published a posting this week that linked various campaigns targeting the aviation industry to a threat actor based in Nigeria who has been targeting the industry for two years and has successfully run malware campaigns for over five years. “Operation Layover” involves phishing emails disguising as legitimate aerospace organizations that claim to contain a link to a PDF file associated to air travel, such as “trip itinerary details”. Once clicked, the link redirects the user to the Snip3 crypter .VBS script that is hosted on Google Drive, which then encrypts the remote access trojan (RAT) payload and drops it onto the user’s machine. Cisco Talos researchers specifically observed the “AsyncRAT” and “njRAT” during their examination of the campaign’s attacks, and the infection of these RATs could lead to data theft, persistence, and dropping additional payloads onto the targeted machines. The goal of the campaign is to exfiltrate credentials and cookies that the actor can offer to actors of higher sophistication. These credentials and cookies could then be used for initial access in larger, more advanced attacks. The researchers emphasized that the actor behind “Operation Layover” is not technically sophisticated, as it has not developed its own malware and has been identified buying various cryptors from online forums that allow for the used malware to be undetectable. “Operation Layover” provides insight into how low-level threat actors can cause major incidents at large organizations as well as industry-wide issues through the booming cyber-underground market for initial access brokers (IAB). For a more in-depth technical analysis of the campaign as well as indicators of compromise (IOCs), please review Cisco Talos’ posting linked below.