Criminals Using WIM Files in Phishing Campaign

Researchers have recently discovered threat actors leveraging Windows Imaging Format (WIM) files as attachments in malicious campaigns designed to deliver the Agent Tesla remote access trojan (RAT). The malicious WIM files are delivered via emails pretending to come from shipping and delivery companies.

WIM files are used as a file-based disk image format to deploy Windows Vista and later operating systems. Researchers believe that threat actors may have switched to WIM files since they are less likely to be detected as malicious. However, because they can’t be opened on a standard Windows platform and require unique software such as 7-zip to extract, targeted victims are unlikely to go the extra distance to track down a program that will enable them to open the malicious file.

Check out our other blog posts from this past week.