Tag Archive for: malicious

VileRAT Attacking Windows Machines via Malicious Software

/in


A new variant of VileRAT is being distributed through fake software pirate websites to infect Windows systems on a large scale.

This Python-based VileRAT malware family is believed to be specific to the Evilnum threat group, DeathStalker, which has been active since August 2023.

It is frequently observed being spread by the VileLoader loader, which is designed to run VileRAT in-memory and limit on-disk artifacts. 

It functions similarly to conventional remote access tools, allowing attackers to record keystrokes, run commands, and obtain information remotely. Because VileRAT is extensible and modular, actors can use the framework to implement new features.

According to public reports, Evilnum is a hacker-for-hire service with a history of attacking governments, legal offices, financial institutions, and cryptocurrency-related organizations in the Middle East, the UK, the EU, and the Americas.

Document

Run Free ThreatScan on Your Mailbox

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

New Variants of VileRAT

Researchers at Stairwell have seen new activity and VileRAT variants spread through modified, legitimate installers that also carry VileLoader.

Kaspersky reported that in the past, the infection was distributed via malicious documents and LNK files, as well as utilizing companies’ public chatbots. 

New TTP in contrast with their past use of malicious documents

It relies on a malicious Nulloy media player installer that is used to deploy VileLoader. VileLoader is packaged in the Nulloy installer and launched by the NSIS install script.

This copy of VileLoader (NvStTest.exe) is a modified version of a legitimate NVIDIA 3D Vision Test Application.

“VileRAT’s core component is stored in a compressed, Xored, and base64 encoded buffer within the payload unpacked from VileLoader. The decoded output contains a JSON configuration for the implant, containing the time VileRAT was started, control servers, and the encryption key for C2 communication, ” researchers explain.

Final…

Source…

13 Malicious Android Apps You Should Delete Immediately

/in


We’re ending the year with another crop of malicious Android apps you should delete from your phone ASAP.

The McAfee Mobile Research Team uncovered apps in Google Play and third-party app stores that are infected with malware it’s dubbed Xamalicious because it’s “implemented with Xamarin, an open-source framework that allows building Android and iOS apps with .NET and C#.”

Once installed, a malicious app “tries to gain accessibility privileges with social engineering and then it communicates with the command-and-control server to evaluate whether or not to download a second-stage payload.” If the second-stage payload is installed, it can take full control of your device, meaning “it has the potential to perform any type of activity like a spyware or banking trojan without user interaction,” McAfee says.

The apps can also do things like install other apps or click on ads without your consent. The Cash Magnet app, for example, automatically clicks ads and installs apps to fraudulently generate revenue; users think they’re earning points to be redeemable as a retail gift card.

“This means that the developers behind these threats are financially motivated and drive ad-fraud therefore this might be one of the main payloads of Xamalicious,” McAfee says.

McAfee identified 25 apps that contain the threat, 13 of which were distributed on Google Play, some as far back as 2020. It notes that “the usage of the Xamarin framework allowed malware authors to stay active and without detection for a long time, taking advantage of the build process for APK files that worked as a packer to hide the malicious code.

“Malware authors also implemented different obfuscation techniques and custom encryption to exfiltrate data and communicate with the command-and-control server,” McAfee adds.

McAfee estimates the apps have potentially compromised 327,000 devices from Google Play, in addition to any downloads that were made from third-party markets. Most Xamalicious activity was detected in the US, Brazil, and Argentina, though infections were also reported in the UK, Spain, and Germany. 

Google removed the apps from Google Play after McAfee reported them. But there’s a chance you might still have them…

Source…

How the Ledger Connect hacker tricked users into making malicious approvals

/in


The ‘Ledger hacker’ who siphoned away at least $484,000 from multiple Web3 apps on Dec. 14 did so by tricking Web3 users into making malicious token approvals, according to the team behind blockchain security platform Cyvers.

According to public statements made by multiple parties involved, the hack occurred on the morning of Dec. 14. The attacker used a phishing exploit to compromise the computer of a former Ledger employee, gaining access to the employee’s node package manager javascript (NPMJS) account.

Once they gained access, they uploaded a malicious update to Ledger Connect’s GitHub repo. Ledger Connect is a commonly used package for Web3 applications.

Some Web3 apps upgraded to the new version, causing their apps to distribute the malicious code to users’ browsers. Web3 apps Zapper, SushiSwap, Phantom, Balancer, and Revoke.cash were infected with the code.

As a result, the attacker was able to siphon away at least $484,000 from users of these apps. Other apps may be affected as well, and experts have warned that the vulnerability may affect the entire Ethereum Virtual Machine (EVM) ecosystem.

How it could have happened

Speaking to Cointelegraph, Cyvers CEO Deddy Lavid, chief technology officer Meir Dolev, and blockchain analyst Hakal Unal shed further light on how the attack may have occurred.

According to them, the attacker likely used malicious code to display confusing transaction data in the user’s wallet, leading the user to approve transactions they didn’t intend to.

When developers create Web3 apps, they use open-source “connect kits” to allow their apps to connect with users’ wallets, Dolev stated. These kits are stock pieces of code that can be installed in multiple apps, allowing them to handle the connection process without needing to spend time writing code. Ledger’s connect kit is one of the options available to handle this task.

Source…

Cisco Zero-Day Exploited to Implant Malicious Lua Backdoor on Thousands of Devices

/in


Oct 21, 2023NewsroomZero-Day / Vulnerability

Cisco Zero-Day

Cisco has warned of a new zero-day flaw in IOS XE that has been actively exploited by an unknown threat actor to deploy a malicious Lua-based implant on susceptible devices.

Tracked as CVE-2023-20273 (CVSS score: 7.2), the issue relates to a privilege escalation flaw in the web UI feature and is said to have been used alongside CVE-2023-20198 (CVSS score: 10.0) as part of an exploit chain.

“The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination,” Cisco said in an updated advisory published Friday. “This allowed the user to log in with normal user access.”

Cybersecurity

“The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system,” a shortcoming that has been assigned the identifier CVE-2023-20273.

A Cisco spokesperson told The Hacker News that a fix that covers both vulnerabilities has been identified and will be made available to customers starting October 22, 2023. In the interim, it’s recommended to disable the HTTP server feature.

While Cisco had previously mentioned that a now-patched security flaw in the same software (CVE-2021-1435) had been exploited to install the backdoor, the company assessed the vulnerability to be no longer associated with the activity in light of the discovery of the new zero-day.

“An unauthenticated remote actor could exploit these vulnerabilities to take control of an affected system,” the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said. “Specifically, these vulnerabilities allow the actor to create a privileged account that provides complete control over the device.”

Cybersecurity

Successful exploitation of the bugs could allow attackers to gain unfettered remote access to routers and switches, monitor network traffic, inject and redirect network traffic, and use it as a persistent beachhead to the network due to the lack of protection solutions for these devices.

The development comes as more 41,000 Cisco devices running the vulnerable IOS XE software are estimated to have been compromised by threat…

Source…