Search This Blog

Showing posts with label Malicious Payload. Show all posts

Titan-Stealer: A New Golang-based Info-Stealer Malware

Recently, a new Golang-based information stealer malware, named ‘Titan Stealer’ is being promoted by threat actors in their Telegram channel. Initial details regarding the malware were discovered by cybersecurity researcher Will Thomas in November 2022 by using the IoT search engine Shodan. 

Titan is advertised as a malware builder that enables users to alter the malware binary's functionality and the type of data that will be extracted from a victim's system. 

The malware, when launched, initiates a technique called ‘process hollowing’ in order to disseminate the malicious payloads into the memory of a legitimate process called AppLaunch.exe, Microsoft’s .NET ClickOnce Launch Utility. 

According to a recent report by Uptycs security, researchers Karthickkumar Kathiresan and Shilpesh Trivedi say, “the stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files.” 

Targets of The Info Stealer 

The Titan Stealer has been targeting web browsers, including Google Chrome, Mozilla Firefox, Microsoft Edge, Yandex, Opera, Brave, Vivaldi, 7 Star Browser, Iridium Browser, and others. The crypto wallets singled out are Armory, Atomic, Bytecoin, Coinomi, Edge Wallet, Ethereum, Exodus, Guarda, Jaxx Liberty, and Zcash. 

Additionally, it has the ability to collect data from the Telegram desktop app and compile a list of the host's installed programs. 

The gathered information is then transmitted as a Base64-encoded archive file to a remote server under the attacker's control. Additionally, the malware includes a web panel that enables threat actors to access the stolen data. 

How is the Titan Stealer Operated? 

The exact approach used to distribute the malware is still unclear, but the threat actors have utilized numerous methods, such as phishing, malicious ads, and cracked software. 

"One of the primary reasons [threat actors] may be using Golang for their information stealer malware is because it allows them to easily create cross-platform malware that can run on multiple operating systems, such as Windows, Linux, and macOS," says Cyble in its analysis of Titan Stealer. "Additionally, the Go compiled binary files are small in size, making them more difficult to detect by security software." 

The findings come a little over two months after SEKOIA unveiled Aurora Stealer, another Go-based malware that is being used by a number of criminal actors in their campaigns. 

The malware often spreads through websites that mimic a renowned software, with the same domains being continuously updated to host trojanized versions of different programs. 

It is also found to be taking advantage of a tactic called padding in order to artificially inflate the size of the executables to as much as 260MB by adding random data, in order to evade detection by antivirus software. 

Threat Actors Exploit WeTransfer to Spread Lampion Malware


In a new phishing campaign unearthed by Cofense researchers, the Lampion malware is being distributed massively, with hackers exploiting WeTransfer as part of their campaign.

WeTransfer is an internet-based computer file transfer service that can be utilized free of cost, hence it's a no-cost way to circumvent security software that may not detect URLs in emails. 

The malware authors are sending phishing emails from exploited firm accounts requesting customers to download a "Proof of Payment" document from WeTransfer. 

The file sent to the targets is a ZIP archive containing a VBS (Virtual Basic script) file that the user must open in order for the attack to begin. Upon clicking on the file, the script launches a WScript process that manufactures four VBS files with random names. The first is empty, the second has limited functionality, and the third's sole motive is to launch the fourth script. 

According to Cofense researchers, this extra step is unclear, but modular execution approaches are typically preferred for their versatility, allowing easy file swaps. The fourth script initiates a new WScript process that links to two hardcoded URLs to retrieve two DLL files concealed inside password-protected ZIPs. The malicious links lead to Amazon AWS instances. 

The ZIP file password is concealed in the script, so the archives are extracted without user communication. The contained DLL payloads are loaded into memory, allowing Lampion to be stealthily executed on compromised systems. 

Subsequently, the malware initiates extracting data from the computer, and bank accounts, and overlaying its own login forms on login pages. These fake bogus forms are stolen and sent to the hacker when users enter their credentials. 

The Lampion trojan has been active since at least 2019, primarily targeting Spanish-speaking users and employing exploited servers to deploy its malicious ZIPs. 

Last year, the malware was identified exploiting cloud services for hosting the malware for the first time, including Google Drive and pCloud. Recently, in March 2022, Cyware reported an increase in trojan distribution, identifying a hostname link to Bazaar and LockBit operations.

Prevention Tips 

Researchers advised users to apply the following mitigations to defend against malware attacks: 
  • Update software, including operating systems, applications, and firmware frequently 
  • Install OS patches when they are available 
  • Enforce MFA to the greatest extent possible 
  • If you use RDP and/or other potentially risky services, secure and monitor them closely 
  • Employ cryptographic vaults for data safety

LockBit Ransomware Exploits Windows Defender to Load Cobalt Strike Payloads


A hacker linked with the LockBit 3.0 ransomware-as-a-service (RaaS) operation has been identified exploiting the Windows Defender command-line tool to decrypt and install Cobalt Strike payloads.

According to endpoint security firm SentinelOne, the ransomware operator exploited VMware command-line utility called VMwareXferlogs.exe, to alter VMware tool settings and interface in the targeted operating systems, and downloaded a Cobalt Strike payload. The hacker also leveraged a command line tool associated with Windows Defender named “MpCmdRun.exe to” decrypt and load Cobalt Strike payloads. 

Subsequently, the malicious actor exploited the Log4Shell vulnerability which is the bug found in an open-source logging library employed by apps and services across the internet, and implemented a reconnaissance for thorough observation of the network to download the Cobalt Strike Payload.

SentinelOne stated that Windows Defender needs to be vigilant regarding the current scenario as hackers associated with the LockBit ransomware are exploring to abuse “novel living off the land tools” to deploy Cobalt Strike beacons bypassing traditional AV detection tools. 

“Defenders need to be alert to the fact that LockBit ransomware operators and affiliates are exploring and exploiting novel ‘living off the land’ tools to aid them in loading Cobalt Strike beacons and evading some common EDR and traditional AV detection tools,” SentinelOne said. 

“Importantly, tools that should receive careful scrutiny are any that either the organization or the organization’s security software have made exceptions for. Products like VMware and Windows Defender have a high prevalence in the enterprise and a high utility to threat actors if they are allowed to operate outside of the installed security controls,” the company added. 

The LockBit ransomware has been active since 2019 and it has likely been used to target thousands of organizations. 

Earlier this year in June, the Lockbit ransomware gang announced the launch of Lockbit 3.0, a new ransomware-as-a-service offering and a bug bounty program. The group said it will offer rewards ranging between $1,000 and $1 million to security researchers and ethical or unethical hackers for information regarding vulnerabilities in their website, the ransomware encryption process, the Tox messaging app, and bugs exploiting their Tor infrastructure.

Hackers are Using LNK Files to Deploy Malicious Payload


Earlier this month, researchers at McAfee Labs spotted a sophisticated technique where hackers employed email spam and malicious URLs to deliver LNK files to victims. The files command authentic applications like PowerShell, CMD, and MSHTA to download malicious files. 

LNK files are shortcut files that link to an application or file commonly found on a victim’s desktop or throughout a system and end with an .LNK extension. LNK files can be created by the user or automatically by the Windows operating system. 

To identify the true nature of these files we will go through recently identified Emotet malware. In this particular campaign, the hacker targets the victims’ by manually accessing the attached LNK file. Threat actor replaces the original shortcut icon with that of a .pdf file, so that the unsuspecting victim, once they receive the email attachment, can’t spot the difference with a basic visual inspection. 

But the threat is real. Windows shortcut files can be employed to deploy pretty much any malware onto the target endpoint, and in this case, the Emotet payload is downloaded into the victim’s %TEMP% directory. If successful, the malware will be loaded into memory using “regsvr32.exe”, while the original dropper gets deleted from the %TEMP% directory. 

Precautionary tips 

Emotet is a sophisticated and long-lasting malware that has impacted users globally. Threat Actors are constantly adapting their techniques to stay one step ahead of cybersecurity researchers. McAfee Labs is continuously monitoring the activity of Emotet and has published the guidelines to protect users from malware infection. 

• It is important to note that Emotet is an endpoint threat spread via email, therefore endpoint detection and response (EDR) and antivirus tooling are imperative to disrupting this threat. 

• Don’t keep important files in common locations such as the Desktop, My Documents, etc. 

• Use strong passwords and enforce multi-factor authentication wherever possible. 

• Turn on the automatic software update feature on your computer, mobile, and other connected devices wherever possible and pragmatic. 

• Use a trusted anti-virus and Internet security software package on your connected devices, including PC, laptop, and mobile. 

• Avoid clicking on untrusted links and email attachments without verifying their authenticity. 

• Conduct regular backup practices and keep those backups offline or in a separate network.

Purple Fox Backdoor Identified in Malicious Telegram Installers


A novel technique to target computer systems has been discovered. According to a report published by joint efforts between Minerva Labs cybersecurity team, and a MalwareHunterTeam, trojanized installers of the Telegram messaging application are being circulated online to distribute the Purple Fox malware, a Windows-based rootkit that is used to install further malicious payloads on compromised devices. 

The installer for the malicious Telegram application is a compiled AutoIt script called "Telegram Desktop.exe" that drops two files, the legitimate Telegram installer, and a malicious downloader. While the legitimate Telegram installer dropped alongside the downloader isn't implemented, the AutoIT program does run the downloader TextInputh.exe. 

When executed, TextInputh.exe designs a folder named ("1640618495") under the C:\Users\Public\Videos\ directory, and then establishes a connection to the C2 to download a 7z utility and a RAR archive (1.rar). The archive contains the payload and the configuration files, while the 7z program unpack .RAR archives and a file used to load a malicious reflectively.DLL.

The next step includes the creation of a registry key to enable persistence on a compromised device, and five further files are dropped into the ProgramData folder to perform functions, including shutting down a wide spectrum of antivirus processes before Purple Fox is eventually executed.

The Purple Fox Trojan comes in two Windows variants i.e. 32-bit and 64-bit. In March last year, Guardicore Labs uncovered novel worm capabilities integrated into the malware, and thousands of susceptible servers were hijacked to host payloads of Purple Fox. 

Last year in October, a new backdoor named FoxSocket was discovered by Trend Micro researchers, which is believed to be a new inclusion to the existing abilities of the malware. The Purple Fox malware is going to be on the radar of security researchers for a while. It has a unique worm functionality and also contains a rootkit. It also employs stealth and has upgraded backdoors. This makes it worth observing and that is why many are keeping tabs on any developments. 

"The beauty of this attack is that every stage is separated to a different file which is useless without the entire file set," the researchers explained. "This helps the attacker protect his files from AV detection."

Telegram Exploited by Attackers to Spread Malware


Researchers discovered that cybercriminals are using the Echelon info stealer to attack the crypto-wallets of Telegram users in an attempt to deceive new or naïve members of a cryptocurrency discussion group on the messaging network. 

Researchers from SafeGuard Cyber's Division Seven threat analysis section discovered a sample of Echelon in a cryptocurrency-focused Telegram channel in October, according to an investigation published on Thursday. 

The malware used throughout the campaign is designed to exploit credentials from a variety of messaging and file-sharing channels, such as Discord, Edge, FileZilla, OpenVPN, Outlook, and even Telegram itself, as well as a variety of cryptocurrency wallets, which include AtomicWallet, BitcoinCore, ByteCoin, Exodus, Jaxx, and Monero. 

The campaign was a “spray and pray” effort: “Based on the malware and how it was posted, SafeGuard Cyber believes that it was not part of a coordinated campaign, and was simply targeting new or naïve users of the channel,” according to the report. 

Researchers discovered that attackers had been using the handle "Smokes Night" to disseminate Echelon on the channel, although it's unknown how successful they were. "The post did not appear to be a response to any of the surrounding messages in the channel," they added.

According to the researchers, additional users on the channel didn't even appear to detect anything strange or engage with the post. However, this does not imply that the malware did not reach consumers' devices, according to the experts. 

“We did not see anyone respond to ‘Smokes Night’ or complain about the file, though this does not prove that users of the channel did not get infected,” they wrote. 

The Telegram messaging platform has undoubtedly become a hotspot of activity for hackers, who've already taken advantage of its popularity and large attack surface by distributing malware on the network via bots, rogue accounts, and other methods.

Echelon was delivered to the cryptocurrency channel in the form of a.RAR file called "present).rar," which contained three files: "pass – 123.txt," a benign text document comprising a password; "DotNetZip.dll," a non-malicious class library and toolset for manipulating.ZIP files; and "Present.exe," the malicious executable for the Echelon credential stealer. 

The.NET payload also featured numerous characteristics that made it hard to identify or analyze, such as two anti-debugging capabilities that immediately terminate the process if a debugger or other malware analysis techniques are identified, and obfuscation utilizing the open-source ConfuserEx program. 

According to the researchers, additional characteristics of the malware include computer fingerprinting and the ability to take a screenshot of the victim's workstation. According to the researchers, the Echelon sample taken from the campaign uses a compressed.ZIP file to deliver passwords as well as other stolen data and screenshots back to a command-and-control server.

Critical Flaws Discovered in Linux that Enables DNS Cache Poisoning


Researchers at the University of California have unearthed security flaws in the DNS system that could leave vendors at risk of server attacks. 

The hackers can abuse the vulnerability by intercepting the connection from the DNS resolver to the nameserver, thus allowing them to change the server IP addresses linked to several web domains, researchers Keyu Man, Xin’an Zhou, and Zhiyun Qian wrote in a recently published research paper at the ACM CCS 2021 conference. 

"The attack allows an off-path attacker to inject a malicious DNS record into a DNS cache," University of California researchers stated. "SAD DNS attack allows an attacker to redirect any traffic (originally destined to a specific domain) to his own server and then become a man-in-the-middle (MITM) attacker, allowing eavesdropping and tampering of the communication." 

The central to the assault is how Linux manages DNS queries on servers, particularly Internet Control Message Protocol (ICMP) packets. The researchers discovered that these behaviors could be used to infer the User Datagram Protocol (UDP) port number between the resolver and nameserver, something that is otherwise randomized and seems impossible to guess. 

"Surprisingly, we uncover novel side channels that have been lurking in the Linux network stack for over a decade and yet were not previously known," the trio explained in their paper, adding that as much as 38% of DNS resolvers are susceptible to attacks.

However, researchers warned that Linux is not the only threat vector for this assault. "The side channels affect not only Linux but also a wide range of DNS software running on top of it, including BIND, Unbound, and dnsmasq." 

This particular research was based on a previous set of attacks the researchers uncovered and dubbed "SADDNS." The SADDNS research demonstrated how the rate limit on the UDP system could be used to infer the port for the nameserver connection. DNS cache poisoning was originally discovered by the late Dan Kaminsky in 2008. 

"In SADDNS, the key insight is that a shared resource, i.e., ICMP global rate limit shared between the off-path attacker and victim, can be leveraged to send spoofed UDP probes and infer which ephemeral port is used," researchers stated. "Unfortunately, it is unclear how many more such side channels exist in the network stack." 

To mitigate the risks, the researchers propose a number of solutions, such as randomizing the caching structure, rejecting ICMP redirect messages, and setting proper socket options such as IP_PMTUDISC_OMIT, which instructs an operating system to ignore so-called ICMP messages, and therefore completely mitigates the side channel-related processing in the kernel.

Threat Actors Deploy Linux Backdoor on Hacked E-Stores with Software Skimmer


Cybersecurity researchers have uncovered a new hacking strategy that deploys a Linux backdoor on hacked e-commerce servers and exfiltrates customers' personal information, including credit card details. 

According to Sansec researchers, the hackers started automated e-commerce attack probes, testing for dozens of vulnerabilities in e-commerce websites. As soon as one is spotted, the attackers use PHP-coded web skimmer to download and insert fake payment forms into the checkout pages that the hacked online business displays to clients. 

“We found that the attacker started with automated eCommerce attack probes, testing for dozens of weaknesses in common online store platforms. After a day and a half, the attacker found a file upload vulnerability in one of the store’s plugins. S/he then uploaded a web shell and modified the server code to intercept customer data,” the Sansec threat research team stated. 

The Golang-based malware, which was unearthed on the same site by Dutch cyber-security firm Sansec, was downloaded and executed on infiltrated servers as a linux_avp executable. Once deployed, it immediately removes itself from the disk and disguises itself as a "ps -ef" process that would be used to retrieve a list of presently active processes.

While examining the linux_avp backdoor, the researchers discovered that it waits for commands from a Beijing server on Alibaba’s network. Additionally, the malware can gain persistence by inserting a new crontab entry that would redownload the malicious payload from its command-and-control server and reinstall the backdoor if detected and removed or the server restarts. 

Unfortunately, this backdoor remains undetected by anti-malware engines on VirusTotal even though a sample was first uploaded more than one month ago, on October 8th. The uploader might be the linux_avp designer since it was submitted one day after researchers discovered it while examining the e-commerce site breach.

 “Curiously, one individual had submitted the same malware to Virustotal on Oct 8th with the comment test. This was just one day after the successful breach of our customer’s store. The person uploading the malware could very well be the malware author, who wanted to assert that common antivirus engines will not detect their creation,” said researchers.

BotenaGo Botnet is Targeting Millions of Routers and IoT Devices


A new botnet malware called BotenaGo has been discovered in the wild. The malware has the capability to exploit millions of susceptible IoT (Internet of Things) products and routers.

Discovered by AT&T labs, BotenaGo is designed using the Go programming language, which has been gaining popularity of late. Threat actors are using it for making payloads that are harder to detect and reverse engineer. 

According to Bleeping Computer, BotenaGo is flagged by only six out of the 62 antivirus engines on VirusTotal, with some falsely identifying it as the Mirai botnet. 

The botnet incorporates 33 exploits for a variety of routers, modems, and NAS devices, with some notable examples given below: 

  • CVE-2015-2051, CVE-2020-9377, CVE-2016-11021: D-Link routers
  •  CVE-2016-1555, CVE-2017-6077, CVE-2016-6277, CVE-2017-6334: Netgear devices 
  • CVE-2019-19824: Realtek SDK based routers 
  • CVE-2017-18368, CVE-2020-9054: Zyxel routers and NAS devices 
  • CVE-2020-10987: Tenda products 
  • CVE-2014-2321: ZTE modems 
  • CVE-2020-8958: Guangzhou 1GE ONU 

“To deliver its exploit, the malware first queries the target with a simple “GET” request. It then searches the returned data from the “GET” request with each system signature that was mapped to attack functions,” reads the blog post published by AT&T. 

“The string “Server: Boa/0.93.15” is mapped to the function “main_infectFunctionGponFiber,” which attempts to exploit a vulnerable target, allowing the attacker to execute an OS command via a specific web request (CVE-2020-8958).” 

The new botnet targets millions of devices with functions that exploit the above flaws, for example querying Shodan for the string Boa, which is a discontinued open-source web server used in embedded applications, and one that still returns nearly two million internet-facing devices on Shodan. Once installed, the malware will listen on the ports 31412 and 19412, the latter is used to receive the victim IP. Once a connection with information to that port is received, the bot will exploit each vulnerability on that IP address to gain access. 

Furthermore, the security researchers didn't discover an active C2 communication between BotenaGo and an actor-controlled server, these are possible scenarios hypothesized by the experts: 

1. The malware is part of a multi-stage modular malware attack, and it's not the one responsible for handling communications. 

2. BotenaGo is a new tool used by Mirai operators on specific machines that are known to them, with the attacker(s) operating the infected end-point with targets. 

3. The malware is still under development and was released in the wild accidentally.

North Korean Hackers Targeting Security Researchers with Trojanized IDA Pro


A North Korea-linked hacking group known as Lazarus is likely behind a compromised version of a popular IDA Pro reverse engineering application, in the second Democratic People's Republic of Korea (DPRK) assault against cybersecurity researchers discovered this year.

IDA Pro is an application that converts an executable file into assembly language, allowing cybersecurity experts and programmers to examine legitimate software for bugs and to determine malicious behavior. 

Due to its high cost, some researchers often download a pirated cracked version; as with any pirated software, there is always the risk of running malicious executables. This is exactly what ESET researcher Anton Cherepanov spotted in a compromised version of IDA Pro 7.5, distributed by the Lazarus hacker group. 

Threat actors inject two malicious DLLs named idahelp.dll and win_fw.dll into the IDA pro installer that will be launched when the program is installed. The win_fw.dll file manufactures a new task in the Windows Task Scheduler that executes the idahelper.dll program. 

The idahelper.dll will then link to the devguardmap[.]org site and install malicious payloads believed to be the NukeSped remote access trojan. The installed RAT will allow the cybercriminals to gain access to the security researcher's device to steal files, take screenshots, log keystrokes, or execute further commands. 

"Based on the domain and trojanized application, we attribute this malware to known Lazarus activity, previously reported by Google's Threat Analysis Group and Microsoft," ESET tweeted regarding connection to Lazarus.

A North Korean hacking group, tracked as Zinc by Microsoft, has a long history of targeting security researchers with backdoors and remote access trojans. Earlier this year in January, Google revealed that Lazarus designed a plot to launch a mass-scale social media campaign to create fake personas posing as vulnerability researchers. 

Using these personas, the hackers contact other security researchers regarding potential collaboration in vulnerability research. After establishing contact with a researcher, the hackers sent malicious Visual Studio projects with malware as prebuilt binaries. This includes the Comebacker dynamic link library (DLL) which attempts to perform privilege escalation for processes and the Klackring DLL that registers malicious services on the researcher's device. 

APT groups in North Korea are increasing with each passing day and are directly linked to the regime of Kim Jong Un. Lazarus is the largest and most prolific of those groups and is believed to be responsible for an attack on COVID-19 vaccine makers in December 2020, to steal intellectual property.

Links Detected Between MSHTML Zero-Day Attacks and Ransomware Operations


The exploitation of a recently fixed Windows zero-day vulnerability was attributed to known ransomware operators, according to Microsoft and threat intelligence firm RiskIQ.

The existence of the zero-day, called CVE-2021-40444, was revealed on September 7, when Microsoft released countermeasures and cautioned that the vulnerability had been exploited in targeted attacks using specially designed Office documents. 

The vulnerability connected to Office's MSHTML browser engine can and has been misused for remote code execution. As part of its Patch Tuesday updates, Microsoft delivered upgrades on September 14th. 

Microsoft announced the acquisition of RiskIQ in July and posted separate blog posts detailing the attacks exploiting CVE-2021-40444. 

The first exploitation efforts were discovered in mid-August. But Microsoft observed a massive spike in exploitation attempts when the proof-of-concept (PoC) code and other details were made public after the initial announcement. 

As per the company, several threat actors, including ransomware-as-a-service affiliates, have used the public PoC code, but some of the exploitation attempts are part of testing rather than criminal operations. 

The company initially saw less than ten exploitation attempts and leveraged CVE-2021-40444 to deliver custom Cobalt Strike Beacon loaders. Microsoft has identified the attackers as DEV-0413 — DEV is allotted to emerging threat groups or unusual activity. To deliver the malware, they apparently used emails referencing contracts and legal agreements to get the targets to open documents formatted to abuse the MSHTML vulnerability.

Surprisingly, the Cobalt Strike infrastructure utilised in the assaults has earlier been linked to cybercrime organisations known for targeting big corporations with ransomware like Conti and Ryuk. These threat actors are tracked as Wizard Spider (CrowdStrike), UNC1878 (FireEye), DEV-0193, and DEV-0365 (Microsoft).

RiskIQ stated in its blog post, “Despite the historical connections, we cannot say with confidence that the threat actor behind the zero-day campaign is part of WIZARD SPIDER or its affiliates, or is even a criminal actor at all, though it is possible. If the threat actors were part of these groups, it means they almost surely purchased the zero-day exploit from a third party because they have not previously shown the ability to develop exploit chains of this complexity.” 

The company added, “Instead, we assess with medium confidence that the goal of the operators behind the zero-day may, in fact, be traditional espionage. This goal could easily be obscured by a ransomware deployment and blend into the current wave of targeted ransomware attacks.” 

RiskIQ states that the cyberspies could have gained access to the ransomware infrastructure, or they may have been allowed by the ransomware operators to utilise their infrastructure. Only one group might be involved in espionage and cybercrime, or the two groups use the same bulletproof hosting provider. 

According to Microsoft, the initial malicious document in attacks abusing CVE-2021-40444 emerges from the internet, and it should be labelled as the "mark of the web." 

Microsoft Office should open the document in Protected Mode unless the user specifically allows modification, limiting the misuse. However, if the attackers figure out a means to keep the document from being a “mark of the web,” they may utilise the vulnerability to execute the payload on the page without requiring user input.

Experts Discover Promotheus TDS, An Underground MaaS


Cybersecurity experts from Group-IB in its technical research on Promotheus TDS, an underground MaaS (Malware as a service), found that it has been providing service for distribution of various malware variants such as Campo Loader, Buer Loader, Qbot, Hancitor, IcedID, and SocGholish. Promotheus has been in aggressive use in underground forums since last year. It is a platform where one can send emails, perform social engineering and work along traffic. Besides this, TDS (Traffic Direction System) can also be used for web shell execution and redirecting creation and management, work using proxy, compatible with Google accounts, and also enable users against blacklists. 

Security Week reports "typical attack involving Prometheus TDS starts with a malicious email that either carries a HTML file to redirect the victim to a compromised site, a link to a web shell that performs a redirection. Once the victim follows the link, they are redirected to the Prometheus.Backdoor URL where their data is collected and sent to the Prometheus TDS admin panel, which decides how to serve the next stage." The service can be availed for $250 on a monthly basis. Besides providing distribution of malicious files, TDS is also used for redirecting victims to malicious and Phishing sites. 

The first campaign of Promotheus TDS was found in 2021, along with additional active campaigns, and a total of 3000 users have been found till date. TDS includes of an administrator panel that lets hackers to modify different parameters for malware campaigns, consisting download of malicious files, restricting geolocation, operating systems and browser. Third-party compromised sites are used as a leverage between victims and administrative panels. Experts found a PHP file named 'Promotheus' backdoor in one of these sites. 

It is built to steal user data and transmit it. "The service has been used to send malicious emails to more than 3,000 addresses to date. The most active campaign targeted individuals in Belgium (more than 2,000 emails), while the second largest attack targeted US entities (more than 260 emails targeting government agencies and organizations in sectors such as finance, insurance, healthcare, energy and mining, retail, IT, and cybersecurity)," said the Security Week.

This Malware that Uses Steam Profile Images to Hide Itself


In May 2021, a researcher tweeted about a new malware that hides itself inside Steam profile photos. Except for a warning that the length of the ICC profile data is not acceptable, common online EXIF tools don't provide anything significant about the image. Because the malware is stored in encrypted form inside the PropertyTagICCProfile value instead of an ICC profile. The goal of an ICC profile is to appropriately map colours for output devices like printers. 

Valve's Steam is a video game digital distribution platform. In September 2003, it was released as a separate software client as a mechanism for Valve to give automatic updates for their games, and it was later expanded to include games from third-party publishers. Digital rights management (DRM), server hosting, video streaming, and social networking services are all available through Steam. It also includes community features such as friends lists and groups, cloud storage, and in-game voice and chat functions, as well as game installation and automatic updates.

While concealing malware in the metadata of an image file is not a novel concept, leveraging a gaming platform like Steam has never been done before. This strategy makes sense from the attacker's perspective: It's as simple as updating a profile image file to remove the infection. There are also a lot of valid accounts, and blacklisting the Steam platform would have a lot of unintended consequences. 

It should be emphasised that no installation of Steam – or any other game platform – is required to become a target for this strategy. The Steam platform only acts as a medium for the malicious file to be distributed.  

An external component, which only sees the profile image on one Steam profile, does the hard lifting in terms of downloading, unpacking, and executing the malicious payload. This payload can be transmitted by a variety of methods, including manipulated emails and infected websites. 

The Steam profile image is neither contagious or executable in any way. It acts as a vehicle for the malware itself. It requires the extraction of a second malware. This malware sample's second component is a downloader. It uses TripleDES to decode the payload from the picture and has the password "PjlDbzxS#;8@x.3JT&4MsTqE0" hardcoded.