TA558 Hackers Weaponize Images for Wide-Scale Malware Attacks

The risk actor tracked as TA558 has been noticed leveraging steganography as an obfuscation strategy to provide a extensive assortment of malware this sort of as Agent Tesla, FormBook, Remcos RAT, LokiBot, GuLoader, Snake Keylogger, and XWorm, amongst many others.

“The team built intensive use of steganography by sending VBSs, PowerShell code, as well as RTF paperwork with an embedded exploit, inside illustrations or photos and text data files,” Russian cybersecurity business Favourable Systems explained in a Monday report.

The campaign has been codenamed SteganoAmor for its reliance on steganography and the alternative of file names this sort of as greatloverstory.vbs and easytolove.vbs.

A the vast majority of the attacks have targeted industrial, expert services, general public, electric powered electricity, and design sectors in Latin American international locations, although businesses located in Russia, Romania, and Turkey have also been singled out.

The improvement arrives as TA558 has also been spotted deploying Venom RAT by using phishing attacks aimed at enterprises situated in Spain, Mexico, the United States, Colombia, Portugal, Brazil, Dominican Republic, and Argentina.

It all starts with a phishing email made up of a booby-trapped email Microsoft Excel attachment that exploits a now-patched security flaw in Equation Editor (CVE-2017-11882) to download a Visible Standard Script that, in change, fetches the future-phase payload from paste[.]ee.

The obfuscated destructive code takes care of downloading two photographs from an external URL that appear embedded with a Foundation64-encoded component that in the long run retrieves and executes the Agent Tesla malware on the compromised host.

Past Agent Tesla, other variants of the attack chain have led to an assortment of malware such as FormBook, GuLoader, LokiBot, Remcos RAT, Snake Keylogger, and XWorm, which are designed for distant obtain, knowledge theft, and supply of secondary payloads.

The phishing emails are despatched from reputable-but-compromised SMTP servers to lend the messages a very little believability and lower the probabilities of them receiving blocked by email gateways. In addition, TA558 has been observed to use contaminated FTP servers to stage the stolen info.

The disclosure will come towards the backdrop of a collection of phishing attacks focusing on authorities corporations in Russia, Belarus, Kazakhstan, Uzbekistan, Kyrgyzstan, Tajikistan, and Armenia with a malware dubbed LazyStealer to harvest qualifications from Google Chrome.

Positive Technologies is monitoring the exercise cluster under the name Lazy Koala in reference to the name of the person (joekoala), who is stated to management the Telegram bots that acquire the stolen data.

That claimed, the sufferer geography and the malware artifacts point out probable one-way links to an additional hacking group tracked by Cisco Talos less than the name YoroTrooper (aka SturgeonPhisher).

“The group’s main instrument is a primitive stealer, whose protection can help to evade detection, sluggish down investigation, seize all the stolen details, and ship it to Telegram, which has been attaining level of popularity with malicious actors by the calendar year,” security researcher Vladislav Lunin reported.

The results also comply with a wave of social engineering campaigns that are made to propagate malware people like FatalRAT and SolarMarker.

Located this post attention-grabbing? Observe us on Twitter  and LinkedIn to go through extra exceptional content we put up.

Some pieces of this short article are sourced from:
thehackernews.com