"The technique used to install the first stage dropper has been changed from socially engineering the victim into opening a malicious document to poisoning the user's web searches with links that deliver a stealthy, signed MSI payload. "The attack chain analyzed in this research shows how the complexity of the attack has grown in order to reach a higher level of stealthiness, using an alternative to the classic approach of compromising victims through phishing emails," Pirozzi explained. The cybersecurity firm said it found additional artifacts that mimic popular apps like Discord and Zoom, suggesting that the attackers had multiple campaigns ongoing beyond leveraging TeamViewer.
"It then adds exclusions, such as regsvr32, *.exe, *.dll, with the cmdlet Add-MpPreference to hide all the components of the malware from Windows Defender." "At first, it disables all the Windows Defender modules through the PowerShell cmdlet Set-MpPreference," SentinelOne Senior Threat Intelligence Researcher Antonio Pirozzi said.
0 kommentar(er)
