FIN6__2019__More_eggs_Anyone_Threat_Actor_ITG08_Strikes_Again.pdf

IBM X-Force IRIS documents an active financially motivated campaign by ITG08/FIN6 that uses spear-phishing job lures to deliver the More_eggs JScript backdoor (aka Terra Loader/SpicyOmelette), Metasploit/Meterpreter stagers, and a signed DLL reverse-shell to steal payment data and maintain persistence; the report provides detailed malware analysis, TTPs, IOCs (domains, IPs, SHA256 hashes), and mitigation recommendations.