In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.
Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.
Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.
Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.
The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.
"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.
The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.
"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."
What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.
The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.
"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."
Related posts- Physical Pentest Tools
- Hacking Tools Name
- Pentest Tools For Android
- Hacking Tools Online
- Hack Tools Pc
- Tools 4 Hack
- Hacking Tools Github
- Nsa Hack Tools Download
- Game Hacking
- Kik Hack Tools
- Pentest Tools Android
- Hacking Tools Free Download
- Pentest Tools Bluekeep
- Pentest Reporting Tools
- Pentest Tools Alternative
- Hacking Tools And Software
- Hacker Tools Software
- Pentest Tools Website
- Hack Tools Github
- Hacker Tools Apk
- Pentest Tools Kali Linux
- Pentest Tools Url Fuzzer
- Hacker Tools Online
- Hacking Tools Software
- Nsa Hack Tools Download
- Hacker Tools Hardware
- Hacking Tools For Kali Linux
- Growth Hacker Tools
- Nsa Hack Tools Download
- Pentest Tools Github
- New Hack Tools
- Hacking Tools And Software
- How To Hack
- Nsa Hack Tools
- World No 1 Hacker Software
- Bluetooth Hacking Tools Kali
- World No 1 Hacker Software
- How To Hack
- Computer Hacker
- Black Hat Hacker Tools
- Hack Tools For Pc
- Pentest Tools Bluekeep
- Beginner Hacker Tools
- Android Hack Tools Github
- Tools For Hacker
- Hacker Tools Hardware
- Beginner Hacker Tools
- Hacker Hardware Tools
- Hack Tools For Pc
- Pentest Tools List
- Hack Tools 2019
- Hacking Tools Usb
- Pentest Tools Windows
- Game Hacking
- Hack Rom Tools
- Pentest Tools Bluekeep
- Pentest Tools List
- Blackhat Hacker Tools
- Pentest Tools Open Source
- Hacking Tools Hardware
- New Hack Tools
- Hack Tools For Windows
- Hacker Tools Github
- Hacking Tools Online
- New Hacker Tools
- Wifi Hacker Tools For Windows
- Hacking Tools For Windows 7
- Pentest Tools For Ubuntu
- Hacking Tools Pc
- Top Pentest Tools
- Hack Tools Github
- Hacker Tools For Mac
- Pentest Tools Url Fuzzer
- Hack Tools Github
- Hacker Tools Github
- New Hack Tools
- Hacking Tools For Windows 7
- Hack Tools Download
- Hacker Tools Software
- Hacking Tools For Pc
- Hacking App
- Top Pentest Tools
- Pentest Tools Online
- Hacker Tools Github
- Hack Tools Online
- Hack Tools For Games
- Computer Hacker
- Hacker Search Tools
- Hacking Tools For Games
- Underground Hacker Sites
- Hacker Tools Windows
- Hack Tools Mac
- New Hack Tools
- Black Hat Hacker Tools
- Hackers Toolbox
- Hacking Tools Name
- Hacker Tools Online
- Top Pentest Tools
- New Hacker Tools
- Pentest Reporting Tools
- Hacker Tools Online
- Hack App
- Termux Hacking Tools 2019
- Pentest Tools Bluekeep
- Pentest Tools Alternative
- Hacker Tools Windows
- Pentest Tools For Android
- Hacking Tools Usb
- Hackers Toolbox
- Pentest Recon Tools
- Best Pentesting Tools 2018
- Hacker Techniques Tools And Incident Handling
- Physical Pentest Tools
- Install Pentest Tools Ubuntu
- Hacker Tools 2019
- Pentest Tools
- Pentest Tools Bluekeep
- Hackrf Tools
- Hacker Tools For Windows
- How To Make Hacking Tools
- Growth Hacker Tools
- Hacking Tools 2019
- Pentest Tools Android
- Best Pentesting Tools 2018
- Hacker Tools Apk Download
- Hacking Tools Github
- Hacking Apps
- Pentest Tools Subdomain
- Hacking Tools Mac
- Hack Tools Download
- Hacking Tools Windows
- Pentest Tools Website
- Hak5 Tools
- Hack Tool Apk No Root
- Growth Hacker Tools
- Hack And Tools
- Hacker Tools Software
- Free Pentest Tools For Windows
- Hacking Tools For Windows Free Download
- How To Install Pentest Tools In Ubuntu
- Hacking App
- Hacker Tools
- How To Hack
No hay comentarios:
Publicar un comentario