The SonicWall Capture Labs threat research team has identified a new development in the Horus Protector distributed infection chain. Recently, it has been targeting the French region with MoDiRAT, a malware notorious for stealing credit card and other victim information.
During the infection process, it deploys the DarkCloud stealer; however, before exiting, the loader verifies if the victim is located in France. If confirmed, it further infects the machine with the MoDiRAT malware. Previously, SonicWall researchers discussed the infection chain followed by Horus Protector, a crypter-loader service used to spread different malware.
Read more…
Source: SonicWall
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- A New Web Skimmer Campaign Targets Real Estate Websites Through Attacking Cloud Video Distribution Supply Chain
January 3, 2022
Supply chain networks are frequent targets for cybercrime, as controlling a weak link in the supply chain can grant cybercriminals access to more victims – especially when the weak link is the source of the supply chain. Recently, we found a supply chain attack leveraging a cloud video platform to distribute skimmer (aka formjacking) campaigns. ...
- Data breach: Broward Health warns 1.3 million patients, staff of ‘medical identity theft’
January 3, 2022
This weekend, the Broward Health hospital system notified more than 1.3 million patients and staff members that their personal information was involved in a data breach that started on October 15. In a statement on Saturday, the Florida hospital system said that in addition to names, addresses and phone numbers, Social Security numbers, bank account information ...
- Israel’s Jerusalem Post website hacked on Soleimani assassination anniversary
January 3, 2022
Israel’s Jerusalem Post newspaper said on Monday its website had been hacked, in what it said was an apparent threat to the country. Instead of displaying a main news page, the website showed an illustration that appeared to recall top Iranian general Qassem Soleimani, who was assassinated in a U.S. drone strike in Iraq on this ...
- Cyber attack on UK’s Defence Academy had ‘significant’ impact, officer in charge at the time reveals
January 2, 2022
A cyber attack – possibly by China or Russia – hit the academic arm of the UK’s Ministry of Defence and had a “significant” impact, the officer in charge at the time has revealed. Air Marshal Edward Stringer, who retired from the armed forces in August, said the “sophisticated” hack – discovered last March – prompted ...
- Firmware attack can drop persistent malware in hidden SSD area
December 30, 2021
Korean researchers have developed a set of attacks against some solid-state drives (SSDs) that could allow planting malware in a location that’s beyond the reach of the user and security solutions. The attack models are for drives with flex capacity features and target a hidden area on the device called over-provisioning, which is widely used by ...
- What the Rise in Cyber-Recon Means for Your Security Strategy
December 30, 2021
As we move into 2022, bad actors are ramping up their reconnaissance efforts to ensure more successful and more impactful cyberattacks. And that means more zero-day exploits are on the horizon. When seen through an attack chain such as the MITRE ATT&CK framework, campaigns are frequently discussed in terms of left-hand and right-hand phases of threats. ...