Cybersecurity researchers have uncovered a novel focused malspam operation deploying password-stealing malware.
The marketing campaign was found by Sophos X-Ops and described in an advisory printed as we speak.
In line with the report, the attackers employed social engineering ways, using emailed complaints about service points or requests for info to ascertain belief with their targets earlier than sending malicious hyperlinks.
The methodology mirrors a beforehand uncovered marketing campaign main as much as the US federal tax submitting deadline in April 2023.
Sophos researchers Andrew Brandt and Sean Gallagher defined that the attackers’ social engineering ways lined a broad spectrum, starting from complaints about alleged violent incidents or theft throughout a visitor’s keep to requests for info on accommodating visitors with particular wants.
As soon as the resort responded to the preliminary inquiry, the risk actors despatched follow-up messages containing purported documentation or proof, which contained a malware payload hidden in a password-protected archive file.
The attackers shared the information from public cloud storage companies, corresponding to Google Drive, utilizing passwords like “123456” to allow victims to open the archives.
Notably, the malware payloads had been designed to evade detection. They’re giant information exceeding 600 MB in measurement, with a lot of the content material being space-filler zeroes.
Moreover, the malware was signed with code-validation certificates, a few of that are new, obtained in the course of the marketing campaign, whereas others seem pretend.
The malware, recognized as Redline Stealer or Vidar Stealer variants, linked to a Telegram channel for command-and-control functions. It exfiltrated knowledge, together with desktop screenshots and browser info, with out establishing persistence on the host machine.
Read more on this malware: RedLine Stealer Malware Deployed Via ScrubCrypt Evasion Tool
Sophos X-Ops mentioned they’ve retrieved over 50 distinctive samples from cloud storage linked to this marketing campaign, and indicators of compromise have been printed on their GitHub repository.
“We have now additionally reported the malicious hyperlinks to the varied cloud storage suppliers internet hosting the malware,” reads the advisory. “Most of these samples displayed few-to-no detections in Virustotal.”
