Intrusions involved luring targets to download a setup binary from legitimate-looking fraudulent websites that directly deploys the Oyster malware, marking a change from the previous usage of a dedicated loader for the payload, according to an analysis from Rapid7. Aside from executing the malware with host data exfiltration, command-and-control communication, and remote code execution capabilities, attacks also entailed the installation of legitimate Microsoft Teams software and a PowerShell script to evade detection and ensure persistence, respectively, researchers said.

Source: SC Magazine