Recently, the SonicWall Capture Labs threat research team has identified various malware strains being distributed through a custom VMDetector Loader. This loader is typically delivered to the victim’s system via image files embedded with steganography. The primary payloads observed include popular malware families such as Remcos, VIPKeyLogger, AveMariaRAT, DCRAT, FormBook, and others.
Attackers send an email with an archive file that includes either JavaScript, VBScript, or HTA content. The embedded scripts employ basic obfuscation through string replacement and base64 encoding, making them appear benign while evading straightforward detection.
Read more…
Source: Sonicwall
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Now this password-stealing Android malware wants to grab your bank details too
January 5, 2023
A prolific and powerful form of Android malware has switched its attention to online banking applications, using abilities including keylogging to steal usernames and passwords for bank accounts, social media profiles and more. Detailed by researchers at cybersecurity company ThreatFabric, the Android malware is part of the SpyNote family, a form of trojan spyware which has ...
- CISA Releases Three Industrial Systems Control Advisories
January 5, 2023
CISA released three Industrial Control Systems (ICS) advisories on January 5 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations: ICSA-23-005-01 Hitachi Energy UNEM ICSA-23-005-02 Hitachi Energy FOXMAN-UN Read more… Source: U.S. Cybersecurity and Infrastructure Security Agency
- Bluebottle: Campaign Hits Banks in French-speaking Countries in Africa
January 5, 2023
Bluebottle, a cyber-crime group that specializes in targeted attacks against the financial sector, is continuing to mount attacks on banks in Francophone countries. The group makes extensive use of living off the land, dual-use tools, and commodity malware, with no custom malware deployed in this campaign. The activity observed by Symantec, a division of Broadcom Software, ...
- PyTorch dependency poisoned with malicious code
January 4, 2023
An unknown attacker used the PyPI code repository to get developers to download a compromised PyTorch dependency that included malicious code designed to steal system data. Developers who last week downloaded the nightly builds of the open source PyTorch framework also unknowingly installed a malicious version of the torchtriton dependency found in the Python Package Index, ...
- Fortinet Releases Security Updates for FortiADC
January 4, 2023
Fortinet has released a security advisory to address a vulnerability in multiple versions of FortiADC. This vulnerability may allow a remote attacker “to execute unauthorized code or commands via specifically crafted HTTP requests.” CISA encourages users and administrators to review Fortinet security advisory FG-IR-22-061 and apply the recommended updates. Read more… Source: U.S. Cybersecurity and Infrastructure Security Agency
- Cook EBITDA slumps £2m following Christmas 2021 cyber-attack
January 4, 2023
A cyber-attack in December 2021 wiped an estimated £2m from Cook’s EBITDA, according to its latest financial results. The attack ground manufacturing systems at its Sittingbourne site to a halt and prevented Cook from making and delivering food. Consequently, the business was forced to shut down its website in the lead-up to Christmas, its busiest period of ...