Cybercriminals Renting WikiLoader to Target Italian Organizations with Banking Trojan

Businesses in Italy are the concentrate on of a new phishing marketing campaign that leverages a new strain of malware called WikiLoader with an supreme purpose to install a banking trojan, stealer, and spy ware referred to as Ursnif (aka Gozi).

“It is a refined downloader with the goal of installing a 2nd malware payload,” Proofpoint reported in a specialized report. “The malware utilizes many mechanisms to evade detection and was most likely created as a malware that can be rented out to find cybercriminal danger actors.”

WikiLoader is so named due to the malware producing a ask for to Wikipedia and checking that the response has the string “The No cost.”

The company security business explained it to start with detected the malware in the wild on December 27, 2022, in connection with an intrusion set mounted by a danger actor it tracks as TA544, which is also identified as Bamboo Spider and Zeus Panda.

The campaigns are centered close to the use of e-mail containing possibly Microsoft Excel, Microsoft OneNote, or PDF attachments that act as a entice to deploy the downloader, which is subsequently made use of to install Ursnif.

In a sign that WikiLoader is shared between numerous cybercrime groups, the threat actor dubbed TA551 (aka Shathak) has also been noticed employing the malware as of late March 2023.

Latest TA544 campaigns detected in mid-July 2023 have used accounting themes to propagate PDF attachments with URLs that, when clicked, guide to the delivery of a ZIP archive file, which, in convert, packs a JavaScript file built to obtain and execute WikiLoader.

WikiLoader is intensely obfuscated and comes with evasive maneuvers to bypass endpoint security program and keep away from detonation in automatic investigation environments. It truly is also engineered to retrieve and run a shellcode payload hosted on Discord, which is finally employed to start Ursnif.

Upcoming WEBINARShield Towards Insider Threats: Learn SaaS Security Posture Administration

Worried about insider threats? We have obtained you covered! Sign up for this webinar to examine realistic procedures and the strategies of proactive security with SaaS Security Posture Administration.

Be part of Now

“It is at this time below lively growth, and its authors surface to make typical adjustments to check out and continue being undetected and fly underneath the radar,” Selena Larson, senior risk intelligence analyst at Proofpoint, stated in a assertion.

“It is very likely extra criminal danger actors will use this, specifically those people known as initial accessibility brokers (IABs) that conduct normal activity that prospects to ransomware. Defenders ought to be mindful of this new malware and activities included in payload shipping, and take measures to safeguard their companies towards exploitation.”

Located this report attention-grabbing? Stick to us on Twitter  and LinkedIn to go through a lot more distinctive information we put up.

Some pieces of this write-up are sourced from:
thehackernews.com