Maverc
All articlesThreat Advisory

Agent Tesla Malware Evolves: A Persistent Threat Exploiting Multiple Vectors

December 31, 20235 min readMaverc Threat Research · Threat Advisory
Threat AdvisoryVulnerabilitiesIdentity SecurityEmail SecurityMalwareNetwork Security
Agent Tesla Malware Evolves: A Persistent Threat Exploiting Multiple Vectors

A new Agent Tesla variant is being distributed through sophisticated phishing campaigns. Here's what's new and what to detect.

A recent cybersecurity analysis sheds light on a sophisticated phishing campaign distributing a new variant of the notorious Agent Tesla malware. Agent Tesla is a long-running .NET-based information stealer and remote access trojan that continues to evolve faster than its age would suggest.

What's New in This Variant

  • Multi-stage delivery using OLE objects, Equation Editor exploits (CVE-2017-11882 still works), and ISO/IMG attachments to bypass mark-of-the-web.
  • Use of legitimate cloud services (Discord CDN, Telegram bots) for second-stage retrieval and exfiltration.
  • Stealing credentials from browsers, email clients, FTP clients, and VPN configurations.
  • Anti-analysis checks for sandboxes and analyst tooling.

What to Detect

  • Office documents loading EQNEDT32.EXE (the Equation Editor).
  • Mounted ISO/IMG files spawning executables.
  • Outbound traffic to Discord CDN and Telegram Bot API from non-developer hosts.
  • Process trees where Office or PDF readers spawn .NET binaries.

Agent Tesla campaigns target small and midsize businesses heavily because the operators rent the malware as a service and prioritize volume. Email gateway hardening, attachment sandboxing, and EDR detections for the patterns above are the most effective controls.

Keep reading

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack
Identity Security

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack

Push-based MFA was a decade-old patch on a broken model. Here's how AiTM toolkits like EvilProxy and Tycoon 2FA defeat it — and the phishing-resistant controls that actually stop them.

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had
Compliance

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had

If you handle CUI, the C3PAO assessment is coming. Here's the 10-step readiness path Maverc walks every defense industrial base client through before the auditor shows up.

What a Modern OT Ransomware Attack Looks Like — And How to Survive One
OT / ICS Security

What a Modern OT Ransomware Attack Looks Like — And How to Survive One

From IT pivot to PLC shutdown, today's OT ransomware crews follow a repeatable playbook. Here is what we see in the field and the segmentation controls that contain the blast.