New Ursnif Variant Likely Shifting Focus to Ransomware and Data Theft

The Ursnif malware has turn into the newest malware to drop its roots as a banking trojan to revamp alone into a generic backdoor able of providing following-phase payloads, signing up for the likes of Emotet, Qakbot, and TrickBot.

“This is a significant shift from the malware’s initial function to help banking fraud, but is dependable with the broader threat landscape,” Mandiant scientists Sandor Nemes, Sulian Lebegue, and Jessa Valdez disclosed in a Wednesday analysis.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The refreshed and refactored variant, initially noticed by the Google-owned menace intelligence agency in the wild on June 23, 2022, has been codenamed LDR4, in what is actually currently being observed as an attempt to lay the groundwork for potential ransomware and information theft extortion functions.

Ursnif, also termed Gozi or ISFB, is a person of the oldest banker malware family members, with the earliest documented attacks going as significantly again as 2007. Verify Stage, in August 2020, mapped the “divergent evolution of Gozi” more than the decades, even though pointing out its fragmented growth history.

Just about a yr afterwards in late June 2021, a Romanian threat actor, Mihai Ionut Paunescu, was arrested by Colombian legislation enforcement officers for his purpose in propagating the malware to no less than a million computers from 2007 to 2012.

The most current attack chain thorough by Mandiant demonstrates the use of recruitment and invoice-linked email lures as an initial intrusion vector to down load a Microsoft Excel doc, which then fetches and launches the malware.

The important refurbishment of Ursnif eschews all its banking-associated capabilities and modules in favor of retrieving a VNC module and attaining a remote shell into the compromised device, which are carried out by connecting to a remote server to get explained commands.

“These shifts could mirror the threat actors’ improved concentration towards taking part in or enabling ransomware functions in the long term,” the researchers explained.

Identified this report attention-grabbing? Follow THN on Fb, Twitter  and LinkedIn to go through a lot more exclusive articles we put up.