SYS01 Stealer Targets Critical Infrastructure With Google Ads

The details stealer known as SYS01 has been utilised by risk actors considering the fact that November 2022 to infect devices of critical federal government infrastructure workers and producing providers, amid other folks.

The new campaign, spotted by security researchers at Morphisec, lured Facebook business enterprise accounts with Google adverts and bogus Facebook profiles selling online games, adult content and cracked computer software. The entice then led to a destructive backlink down load.

“The attack is intended to steal delicate facts, which includes login info, cookies, and Fb advert and business enterprise account details,” wrote Morphisec malware researcher Arnold Osipov in Tuesday’s advisory.

“The marketing campaign was initially viewed in Could 2022 and was to begin with attributed to the Ducktail procedure by Zscaler. This attribution was later learned to be incorrect,” Osipov added.

Mike Parkin, Senior Technical Engineer at Vulcan Cyber, agreed with Osipov’s examination, adding that Morphisec’s new exploration exhibits the threat actor is still energetic and development of their malware is ongoing.

“They also reference a different, but apparently associated, malware found out by a further research staff,” Parkin added. “Taken as a whole, this highlights how menace actors evolve their equipment and aim on certain targets more than time. And how hard it can be to firmly attribute unique malware strains to distinct teams when equally the malware and groups that use it are continuously in flux.”

The attacks noticed by Morphisec experienced the SYS01 stealer sent in distinct means, which includes DLL side-loading, and via Rust and Python executables.

In accordance to John Anthony Smith, CEO of Conversant Group, the campaign displays how risk actors are progressively applying ad content material to entice customers into clicking malicious back links.

“SYS01, in our feeling, is a continuation of related approaches employed by other groups. Any messaging platform that makes it possible for a consumer to click uninspected one-way links or attachments must be blocked,” the govt spelled out.

“Ads, social network platforms, chat purposes/services and […] all platforms that enable communication outdoors of the corporately sanctioned methods should really be blocked.”

A identical marketing campaign by the aforementioned Ducktail danger actors was spotted by the WithSecure group and disclosed in November 2022.

Some areas of this post are sourced from:
www.infosecurity-journal.com