Tag Archive for: Word

A sneaky new steganography malware is exploiting Microsoft Word — hundreds of firms around the world hit by attack

/in


Hackers have been observed using steganography to target hundreds of organizations in Latin America with infostealers, remote access trojans (RAT), and more. 

The campaign, dubbed SteganoArmor, was discovered by researchers from Positive Technologies.

Source…

Decoy Microsoft Word Documents Used to Deliver Nim-Based Malware

/in


Dec 22, 2023NewsroomSocial Engineering / Malware Analysis

Nim-Based Malware

A new phishing campaign is leveraging decoy Microsoft Word documents as bait to deliver a backdoor written in the Nim programming language.

“Malware written in uncommon programming languages puts the security community at a disadvantage as researchers and reverse engineers’ unfamiliarity can hamper their investigation,” Netskope researchers Ghanashyam Satpathy and Jan Michael Alcantara said.

Nim-based malware has been a rarity in the threat landscape, although that has been slowly changing in recent years as attackers continue to either develop custom tools from scratch using the language or port existing versions of their nefarious programs to it.

This has been demonstrated in the case of loaders such as NimzaLoader, Nimbda, IceXLoader, as well as ransomware families tracked under the names Dark Power and Kanti.

The attack chain documented by Netskope begins with a phishing email containing a Word document attachment that, when opened, urges the recipient to enable macros to activate the deployment of the Nim malware. The email sender disguises themselves as a Nepali government official.

Once launched, the implant is responsible for enumerating running processes to determine the existence of known analysis tools on the infected host and promptly terminate itself should it find one.

UPCOMING WEBINAR

Beat AI-Powered Threats with Zero Trust – Webinar for Security Professionals

Traditional security measures won’t cut it in today’s world. It’s time for Zero Trust Security. Secure your data like never before.

Join Now

Otherwise, the backdoor establishes connections with a remote server that mimics a government domain from Nepal, including the National Information Technology Center (NITC) and awaits further instructions. The command-and-control (C2) servers are no longer accessible –

  • mail[.]mofa[.]govnp[.]org
  • nitc[.]govnp[.]org
  • mx1[.]nepal[.]govnp[.]org
  • dns[.]govnp[.]org

“Nim is a statically typed compiled programming language,” the researchers said. “Aside from its familiar syntax, its cross-compilation features allow attackers to write one malware variant and have it cross-compiled to target different…

Source…

Konni Group Use Weaponized Word Documents Deliver RAT Malware

/in


In the ever-evolving cybersecurity domain, the resurgence of NetSupport RAT, a Remote Access Trojan (RAT), has raised concerns among security professionals. 

This sophisticated malware, initially developed as a legitimate remote administration tool, has been repurposed by malicious actors to infiltrate systems and establish remote control.

NetSupport Manager, the software upon which NetSupport RAT is based, originated as a genuine remote technical support tool three decades ago. 

It provided capabilities for file transfers, support chat, inventory management, and remote access. 

While its initial purpose was legitimate, threat actors have exploited its functionalities for malicious purposes.

Document

Free Webinar

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

In collaboration with the Threat Analysis Unit, the Carbon Black Managed Detection & Response (MDR) team has witnessed a significant increase in NetSupport RAT infections in recent weeks. 

This surge primarily affects Education, Government, and Business Services organizations.

Delivery Mechanisms and Actor Landscape

The distribution of NetSupport RAT involves a variety of tactics, including fraudulent updates, drive-by downloads, exploitation of malware loaders like GhostPulse, and phishing campaigns. 

Unlike some malware exclusively utilized by specific threat actors, NetSupport RAT has been employed by a range of malicious entities, from novice hackers to sophisticated adversaries.

Recent NetSupport RAT attacks typically involve tricking victims into downloading fake browser updates from compromised websites. 

The initial infection process may vary depending on the specific threat actor’s methodology.

One observed infection scenario involves a victim downloading a fake browser update from a compromised website. 

This update hosts a PHP script that displays a seemingly authentic update prompt. 

Upon…

Source…

Despite word of ‘radical malware attack,’ it took hours to shut down Suffolk’s computer network

/in


The email sent at 11:18 a.m. on Sept. 8 from a top computer manager at the Suffolk County Clerk’s Office to the Bellone administration’s technology commissioner was as blunt as it was chilling.

“We are currently experiencing a radical malware attack and we shut down all outside access to the systems until such time as we are safe,” said the email, which was obtained by Newsday.

Yet, more than four hours had elapsed before the rest of the county’s computer networks, encompassing nearly 600 servers from Hauppauge to Riverhead, were severed from access to the outside world, starting the clock on the county’s broader response to one of the most devastating ransomware attacks faced by a U.S. municipality of any size in the history of such cyberattacks.

A series of emails obtained by Newsday from the day of the attack and the day prior show that awareness of the attack had been slowly dawning on technology staff and officials in the 24 hours preceding the shutdown. Among those was the actual ransomware message, first circulated at 10:53 a.m. on Sept. 8, 25 minutes before the clerk’s office shut down.

WHAT TO KNOW

  • More than four hours passed between the time Suffolk County was warned of a “radical malware attack” and most of the county’s computer networks were shut down.
  • Emails obtained by Newsday show that awareness of the attack had been slowly dawning on technology staff and officials in the 24 hours preceding the shutdown.
  • The cyberattack on Suffolk could be one of the most expensive attacks in U.S. history on municipal governments.

Whether the four-hour lag in shutting down all county computer networks caused a sizable loss of data is open for debate. One tech expert called it “significant,” but said that considerably more data could have been taken in the days and weeks before the Black Cat/ALPHV message was first noted in a 10:53 email. Suffolk Comptroller John M. Kennedy Jr. said it likely made the difference between the clerk’s unscathed backup data and the impacts that continue to ripple through Bellone administration operations. 

The emails obtained by Newsday provide a limited look inside the attack at the time it was happening, chiefly…

Source…