Hacks

The Cyberthreat uses COVID-19 themed malspam to distribute the  Trickbot  malware, says IBM Security Researchers. This time attacker utilizes FMLA ( Family and Medical Leave Act)  to lure the user over COVID-19 medical leaves with the attachment named “Family and Medical Leave of Act 22.04.doc” to distribute the malware. Spam mail disguised to come from the U.S. Department of Labor (DoL). Trickbot Campaigns TrickBot is a sophisticated banking Trojan operated by an organized cybercrime gang. Users infected with the TrickBot Trojan becomes part of a botnet that can allow attackers to gain complete control of the device. Typical consequences of TrickBot infections are bank account takeover, high-value wire fraud, and possibly ransomware attacks targeting organizational networks. Mainly financially motivated cyber-attacks. DocuSign themes used by Trickbot Sample email US-DoL.eml, contains three attachments: uslogo.png, faq.png, and Family and Medical L...

Microsoft has taken down the infamous Necurs botnet that impacted more than nine million computers worldwide. The Necurs botnet is the largest spam and malware botnet. The botnet is known for distributing several malware particularly the Locky ransomware malware, the botnet believed to be operated from Russia. The Necurs botnet was first detected in 2012, it primarily acts as a dropper for other malware, between the years 2016 to 2019 the botnet emerges as largets one and responsible for 90% of the malware spread by email worldwide. Necurs Botnet TakeDown The world’s largest botnet was taken down as a coordinated operation between Microsoft and partners across 35 countries. Microsoft  said  that within a “58-day period in our investigation, for example, we observed that one Necurs-infected computer sent a total of 3.8 million spam emails to over 40.6 million potential victims.” The botnet is known for conducting various spam attacks such as stock scams, fake ...

Researchers discovered a new wave of Azorult malware campaign that abusing the protonVPN and dropper the malware payload as a fake ProtonVPN installer to infect the Windows System. GBHackers reported  several incidents  involved by the Azorult malware campaign and is one of the well-known malware that often sold in Russian forums for the higher price ($100) since this malware contains a broad range of persistent functionality. In this current attack scenario, Threat actors created a fake ProtonVPN website which is an exact HTTrack copy of the original ProtonVPN website through which they spreading the malware as an installer package to compromised the Windows users. Fake ProtonVPN website The campaign initially started in November 2019 and the attacker register the domain under the name of ProtonVPN{.}store and is Registrar used for this campaign is from Russia. Infection Vectors Attackers handling several infection vectors to spread this malware and infect the v...

Researchers discovered a new wave of custom malware campaign named as “Dudell” from previous unknown cyberespionage group dubbed  Rancor . Rancor Threat group active since 2017, and they continuously targeting the government organization until January 2019, in this current campaign, researchers discovered an undocumented custom malware. Additionally, the group using another malware family called “Derusbi” to load a secondary payload once it infiltrates a target, and malware will be installed in the victim’s machine by conducting 2 rounds of attack. Researchers observed that, the attacker sent via 149.28.156[.]61 to deliver either Derusbi or KHRat samples with either  cswksfwq.kfesv[.]xyz or connect.bafunpda[.]xyz as C2. Rancor has a record of conducting targeted attacks in Southeast Asia throughout 2017 and 2018. DUDELL Malware Infection Process DUDELL malware initially observed form weaponized Microsoft excel document via malspam...

TrickBot is one of the top  modular banking malware  that primarily targets financial information of users’ and also it acts as a dropper for other malware. The malware was first spotted in 2016 and it was mostly distributed via malvertising campaign, it evolves from a small banking trojan to an Access-as-a-Service model. Trickbot New Malware Campaign Unit 42 security researchers observed a new distribution campaign that delivered through phishing emails that has the subject lines as payroll or annual bonuses. The campaign includes embedded links points to the legitimate Google Docs document which contains links to download the malicious file from Google drive. For further obfuscation email delivered through SendGrid. According to Unit 42  research , “the email appeared to be originated from individuals at .edu email addresses and then attackers used SendGrid’s EDS to distribute the malware.” The email contains the attractive text and links, once the user...

Researchers discovered a new malicious activity that involved by Russian APT hackers to attack Government and Military officials in Ukrainian entities. The attacker’s targets are not limited but they also infect various individuals who is part of the government and Law enforcement, Journalists, Diplomats, NGO and the Ministry of Foreign Affairs. Researchers believe that the campaign attributed to Gamaredon activity in which attackers using Dynamic Domain Name Server as C2 server, VBA macro, and VBA script as a part of this attack. Threat actors using weaponized DOCX files during the intelligence collection in the target and its distributed via spearphishing emails. Gamaredon is using weaponized documents, sometimes retrieved from legitimate sources as the initial infection vector. Researchers observed the malicious sample that reveals the APT activity from at least September 2019 to November 25, 2019. Malware infection Process Researchers observed some of the lure do...

Cybersecurity researchers have spotted a new variant of the Snatch ransomware that first reboots infected Windows computers into Safe Mode and only then encrypts victims' files to avoid antivirus detection. Unlike traditional malware, the new Snatch ransomware chooses to run in Safe Mode because in the diagnostic mode Windows operating system starts with a minimal set of drivers and services without loading most of the third-party startup programs, including antivirus software. Snatch has been active since at least the summer of 2018, but SophosLabs researchers spotted the Safe Mode enhancement to this ransomware strain only in recent cyber attacks against various entities they investigated. "SophosLabs researchers have been investigating an ongoing series of ransomware attacks in which the ransomware executable forces the Windows machine to reboot into Safe Mode before beginning the encryption process," the  researchers say . "The ransomware, which calls itsel...

Researchers discovered a new  malware  campaign that drops two different Remote Access Trojan(RAT) on targeted Windows systems and steal sensitive information from popular browsers such as Chrome and Firefox. The samples that uncovered by Fortinet researchers drop the RevengeRAT and WSHRAT malware and it has various obfuscation functionalities that use the various stage to maintain the persistence. RAR’s Infection Process RevengeRAT The RAT has infected the victims by utilizing the different stages. When opening the malicious sample file, it contained JavaScript code in a text editor with encoded data. Once decoded its drops the VBScript code is responsible for drop the next stage of malware. The dropper then later download the second stage of malicious downloader( “A6p.vbs” file) from the external website which also contains an obfuscated strings to avoid detection. If the downloader script will be successfully executed then it establishes a connection with...