Businesses told to guard against PowerPepper Windows exploit

Security scientists have disclosed specifics of a new in-memory Windows backdoor developed by hackers for employ that can execute remote code on targets in Europe, Asia, and the US to steal sensitive info.

This new malware, dubbed PowerPepper, has been credited to hackers-for-hire group DeathStalker. This APT team has been active considering the fact that 2012 and previously specific regulation companies and economical firms in Europe and the Center East, in accordance to Kaspersky Lab researcher Pierre Delcher.

In a web site publish, Delcher claimed that the new backdoor is made to execute remote shell instructions. The malware will try to evade detection with various tips, these as detecting mouse actions, filtering the client’s MAC addresses, and adapting its execution circulation based on detected antivirus products.

To start an attack, DeathStalker generally depends on spear-phishing email messages with attachments, or backlinks to public file-sharing solutions, as nicely as script execution primarily based on Windows shortcuts. The email messages normally involve topics these kinds of as carbon emission rules, vacation scheduling, and the coronavirus pandemic.

The major payload of the malware is hidden in obfuscated material hosted on significant public web expert services like YouTube, Twitter or Reddit when decoded by malware, this material reveals a command-and-regulate (C2) server address. The malware also appears to be hidden in a photo of a bunch of peppers, which is where it will get its title.

A loader script extracts the malicious code and, when executed, PowerPepper commences to execute distant shell instructions despatched by the hackers. These commands are utilized to steal delicate business info and carry out reconnaissance.

So much, favoured targets of PowerPepper appear to be companies specialising in law and consultancy, based in Europe, Aisa, and the US.

“The DeathStalker danger is surely a lead to for issue, with the victimology for its a variety of malware strains displaying that any corporation or individual in the globe can be specific by their malicious functions, provided another person has resolved they are of fascination and passed on the word to the danger actor,” said Delcher.

“Luckily for defenders, DeathStalker has, right until now, relied on a somewhat confined set of methods to style and design its supply chains, and implementing counter-steps is an attainable objective for most companies.”

Some areas of this posting are sourced from:
www.itpro.co.uk