“Re: Purchase Order ….>,” bait for HawkEye from South Korea. The zipped attachment contains an exe file: the malware. The stolen data is exfiltrated via FTP to a host in Russia

“Re: Purchase Order ….>,” is an email from an IP in South Korea carrying HawkEye.

The compressed attachment contains an exe file: the malware. The stolen data is exfiltrated via FTP to a host in Russia.

HawkEye through the keylogger function, can capture everything the user types. Furthermore, it is capable of stealing emails and browser credentials and taking screenshots. Finally, it has the ability to remotely issue commands to the infected PC, such as downloading additional payloads or updating existing ones.