Cyber Incident Victim: Embassy of Bangladesh in Egypt
Date:
Oct 2018
Location:
Egypt
Summary
The website of the Bangladeshi Embassy in Egypt was compromised to distribute malicious Word documents that exploited a known vulnerability to execute remote code, installing malware downloaders on affected systems. Initially detected hosting a coinminer, the site later delivered a malicious document triggering the download of Godzilla Loader, which established connections to command-and-control servers for further payload retrieval. The attackers leveraged a document vulnerability to deploy the malware, which operated undetected as the compromise persisted despite security notifications.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The website for the Embassy of Bangladesh in Cairo was compromised in October 2018, as detected by Trustwave’s Cloud SWG product, which identified the presence of a coinminer on the site. The initial compromise evolved by January 2019, when the site began automatically forcing visitors to download a malicious Word document titled *Conference_Details.docx* upon accessing any HTML page. Trustwave researchers analyzed the document and confirmed it exploited the Encapsulated PostScript (EPS) vulnerability CVE-2017-0261, a remote code execution flaw affecting affected systems. Successful exploitation enabled attackers to install malware into the *C:\ProgramData\Microsoft\Windows\DRM* directory, specifically a file named *MSBuld.exe*. VirusTotal initially flagged this file as a password-stealing Trojan, but Trustwave attributed it to Godzilla Loader, a malware downloader. Once executed, Godzilla Loader established connections to a command-and-control (C2) server to retrieve additional malicious payloads.
The compromise persisted unresolved, as Trustwave reported no response from the domain owners despite outreach attempts. The embassy’s website remained infected at the time of Trustwave’s public disclosure in February 2019. The incident exposed visitors to drive-by download attacks, risking unauthorized remote access, credential theft, and secondary malware infections. The attackers leveraged a known vulnerability in Microsoft Office to deploy persistent malware, indicating a deliberate targeting of embassy website visitors. No remediation efforts by the embassy or third parties were documented in the available source material. The prolonged compromise underscored operational security gaps, as the site continued distributing malicious payloads for months without intervention.