Experts Uncover New Evasive SquidLoader Malware Targeting Chinese Organizations

Cybersecurity researchers have uncovered a new evasive malware loader named SquidLoader that spreads by means of phishing strategies focusing on Chinese businesses.

AT&T LevelBlue Labs, which first observed the malware in late April 2024, stated it incorporates attributes that are developed to thwart static and dynamic examination and finally evade detection.

Attack chains leverage phishing email messages that occur with attachments that masquerade as Microsoft Word files, but, in fact, are binaries that pave the way for the execution of the malware, which is then utilised to fetch 2nd-phase shellcode payloads from a remote server, together with Cobalt Strike.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“These loaders feature weighty evasion and decoy mechanisms which help them remain undetected while also hindering evaluation,” security researcher Fernando Dominguez said. “The shellcode that is shipped is also loaded in the exact same loader approach, very likely to stay away from writing the payload to disk and consequently risk getting detected.”

Some of the defensive evasion techniques adopted by SquidLoader encompass the use of encrypted code segments, pointless code that continues to be unused, Handle Stream Graph (CFG) obfuscation, debugger detection, and doing immediate syscalls rather of calling Windows NT APIs.

Loader malware has develop into a well known commodity in the felony underground for threat actors searching to supply and launch additional payloads to compromised hosts, although bypassing antivirus defenses and other security actions.

Final 12 months, Aon’s Stroz Friedberg incident in-depth a loader regarded as Taurus Loader that has been observed distributing the Taurus facts stealer as effectively as AgentVX, a trojan with abilities to execute far more malware and established up persistence making use of Windows Registry variations, and gather data.

The development will come as a new in-depth assessment of a malware loader and backdoor referred to as PikaBot has highlighted that it continues to be actively developed by its developers given that its emergence in February 2023.

“The malware employs state-of-the-art anti-evaluation methods to evade detection and harden assessment, which include program checks, oblique syscalls, encryption of upcoming-phase and strings, and dynamic API resolution,” Sekoia mentioned. “The recent updates to the malware have more increased its abilities, producing it even extra challenging to detect and mitigate.”

It also follows results from BitSight that the infrastructure linked to a different loader malware known as Latrodectus has long gone offline in the wake of a regulation enforcement exertion dubbed Operation Endgame that saw in excess of 100 botnet servers, like these connected with IcedID, SystemBC, PikaBot, SmokeLoader, Bumblebee, and TrickBot, dismantled.

The cybersecurity enterprise explained it observed nearly 5,000 unique victims spread throughout 10 distinct campaigns, with a the greater part of the victims situated in the U.S., the U.K., the Netherlands, Poland, France, Czechia, Japan, Australia, Germany, and Canada.

Uncovered this short article attention-grabbing? Follow us on Twitter  and LinkedIn to read through more exclusive content material we put up.