Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant

McAfee researchers identified an active Hidden Cobra campaign that delivered the Bankshot backdoor to multiple Turkish government and financial organizations via malicious Word documents embedding an Adobe Flash exploit (CVE-2018-4878). The report provides in-depth static and dynamic analysis of the DLL implant, hardcoded C2 domains and URLs, network communication formats, command handlers, IOCs (file hashes and domains), and describes Bankshot capabilities including file discovery, command execution, process manipulation, data exfiltration, and file-wiping — indicating reconnaissance and potential prelude to financially motivated theft.