Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant | McAfee Blogs

McAfee researchers describe an active Hidden Cobra campaign that used a Flash zero-day (CVE-2018-4878) embedded in spearphishing Word documents to deploy the Bankshot backdoor against multiple Turkish financial and government-controlled financial organizations; the report provides detailed reverse-engineering of the DLL implant, C2 infrastructure and IOCs (file hashes, domains), documents its capabilities (data collection, remote command execution, file wiping), and warns of likely reconnaissance for potential future financial theft.