Search This Blog

Showing posts with label Adobe Acrobat. Show all posts

SolarMarker Malware Utilize Cutting-Edge Techniques


The SolarMarker data thief and gateway operators have been identified using devious Windows Registry ways to maintain long-term persistence on infected systems, indicating that the malicious actors are constantly changing strategy and improving defensive mechanisms.

The. NET-based malware, which boasts data harvesting and backdoor capabilities, has been linked to at least three consecutive attack waves in 2021. The first batch revealed in April, employed search engine poisoning to trick business executives by visiting dodgy Google pages which downloaded SolarMarker on users' PCs. In August, the malware was discovered to be stealing accounts and sensitive information from the healthcare and education sectors.

In the following infection chains revealed by Morphisec in September 2021, the usage of MSI installers to assure malware dissemination was observed. SolarMarker's technique begins with users being directed to decoy sites with drop MSI installer payloads which, while downloading ostensibly legitimate software like Adobe Acrobat Pro DC, Nitro Pro, or Wondershare PDFelement, really launch a PowerShell script.

According to cybersecurity firm Sophos, which noticed the new behavior, despite the operation's end in November 2021, remote management implants are still located on targeted networks."Such SEO efforts, which blended Google Groups consultations with deceitful web pages and PDF documents hosted on infected sites, are beneficial, the SolarMarker lures were ordinarily at or near the top of the search engines for phrases the SolarMarker actors targeted," said Sophos researchers Gabor Szappanos and Sean Gallagher. 

To assure persistence, the PowerShell installer modifies the Registry Entries and drops a.LNK file into Windows' starting directory. This unlawful alteration causes the malware to be delivered from an encrypted payload concealed behind a "smokescreen" of 100 to 300 garbage files built particularly for this purpose.

The researchers explained, "Usually, one might assume this associated file to be an operable or script file." "However, the linked file for these SolarMarker operations is one of the random trash files, therefore cannot be performed by itself."

Furthermore, the linked junk file's unique and random file extension is used to build a custom file type key, which is then used to run an Executable from the Registry to run the malware during system startup. The backdoor, on the other hand, is constantly growing, with features that allow it to capture information from online browsers, facilitate bitcoin theft, and run arbitrary instructions and programs, with the results being sent to a remote server.

The backdoor is continually being updated with new capabilities that make it possible to steal data from the web browsers, ease bitcoin theft, and execute arbitrary commands and applications with the results related to a remote server. 

Hackers Take Advantage of Adobe Zero-Day Vulnerability Impacting Acrobat Reader

 

A patch for Adobe Acrobat, the world's most popular PDF reader, addresses a vulnerability that has been actively exploited and affects both Windows and macOS systems, allowing for arbitrary code execution. 

Adobe is advising customers about a crucial zero-day vulnerability in its widely used Adobe Acrobat PDF reader software that is being actively exploited in the wild. As part of Adobe's Tuesday roundup of 43 fixes for 12 of its products, including Adobe Creative Cloud Desktop Application, Illustrator, InDesign, and Magento, a patch is now available. 

According to Adobe, the CVE-2021-28550 zero-day vulnerability "has been exploited in the wild in selective attacks targeting Adobe Reader users on Windows. Adobe Reader users on Windows may be the only ones that are currently being targeted. The bug, however, affects eight different versions of the software, including those for Windows and Mac. The versions include:

1.Windows Acrobat DC & Reader DC (versions 2021.001.20150 and earlier) 
2.macOS Acrobat DC & Reader DC (versions 2021.001.20149 and earlier) 
3.Windows & macOS Acrobat 2020 & Acrobat Reader 2020 (2020.001.30020 and earlier versions)
4.Windows & macOS Acrobat 2017 & Acrobat Reader 2017 (2017.011.30194  and earlier versions)

Adobe did not have any technical details about the zero-day flaw. Those details are usually available after users have had a chance to apply the patch. Users can manually update their product installations by going to Help > Check for Updates, according to Adobe's May security bulletin, which was released on Tuesday. 

Several other important bugs were included in Tuesday's roundup of 43 fixes. Adobe Acrobat received a total of ten crucial and four significant vulnerability patches. A total of seven of the bugs were arbitrary code execution bugs. Three of the vulnerabilities patched on Tuesday (CVE-2021-21044, CVE-2021-21038, and CVE-2021-21086) expose systems to out-of-bounds write attacks. 

On Tuesday, Adobe Illustrator got the highest number of patches, with five critical code execution vulnerabilities patched. Three of the flaws (CVE-2021-21103, CVE-2021-21104, and CVE-2021-21105), according to Adobe's definition, are memory corruption bugs that enable hackers to execute arbitrary code on targeted systems. The three memory corruption bugs were discovered by Kushal Arvind Shah, a bug-hunter with Fortinet's FortiGuard Labs.