In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.
Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.
Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.
Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.
The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.
"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.
The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.
"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."
What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.
The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.
"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."
Read more
- Pentest Tools Open Source
- Tools 4 Hack
- Hacker Tools Software
- Hacker Techniques Tools And Incident Handling
- Hacker Tools For Windows
- Hack And Tools
- Pentest Tools Open Source
- Hack Tools Online
- Blackhat Hacker Tools
- Hack Website Online Tool
- Hacker Security Tools
- Hacker Tool Kit
- Tools For Hacker
- Growth Hacker Tools
- How To Hack
- Growth Hacker Tools
- Hacking Tools 2020
- Hacker Tools 2019
- New Hack Tools
- Hackrf Tools
- Hackers Toolbox
- Pentest Tools Website Vulnerability
- Pentest Tools For Mac
- Pentest Tools For Mac
- Pentest Tools Download
- Pentest Tools Windows
- Easy Hack Tools
- Termux Hacking Tools 2019
- Underground Hacker Sites
- Hacker Tools For Mac
- Pentest Tools List
- Install Pentest Tools Ubuntu
- How To Make Hacking Tools
- Ethical Hacker Tools
- Hack Tools For Pc
- Hack Tools 2019
- Hacking Tools 2020
- Hacking Tools 2019
- Hacker Tools Free Download
- Hacking Tools And Software
- Hacker Tools 2020
- Pentest Tools Windows
- Pentest Tools Free
- Tools Used For Hacking
- Pentest Tools Find Subdomains
- Hack Tools For Games
- Wifi Hacker Tools For Windows
- Tools 4 Hack
- Hackrf Tools
- Tools For Hacker
- Black Hat Hacker Tools
- Pentest Tools Github
- Hacking Tools For Games
- New Hacker Tools
- Pentest Tools Apk
- Tools 4 Hack
- Pentest Tools Framework
- Hacker Tools 2019
- Hacker Tools Online
- Hack Tool Apk
- Hack Tools For Ubuntu
- What Are Hacking Tools
- Hack Rom Tools
- Hacking Apps
- Hack Tools For Ubuntu
- New Hacker Tools
- Hacker Tools Free
- Hacker Tools Apk Download
- Nsa Hack Tools Download
- Hack Tools
- Hack App
- Usb Pentest Tools
- Pentest Recon Tools
- World No 1 Hacker Software
- Hackers Toolbox
- Hack Rom Tools
- Hack Tools For Ubuntu
- Hacks And Tools
- Pentest Tools For Mac
- How To Hack
- Hacking Tools 2019
- Usb Pentest Tools
- Android Hack Tools Github
- Hack App
- Hacker Security Tools
- Android Hack Tools Github
- Pentest Tools Apk
- Hacking Tools Windows 10
- Hacker Security Tools
- Underground Hacker Sites
- Hack Tools For Mac
- Pentest Tools Url Fuzzer
- Pentest Tools Tcp Port Scanner
- Hacking Tools Mac
- Pentest Tools Download
- Hack Tools For Ubuntu
- Pentest Tools For Ubuntu
- Hacker Tools For Mac
- Hack Tools
- Hacker Tools Github
- Hacker Tools 2020
- Top Pentest Tools
- Pentest Tools For Windows
- Hacking Apps
- Hacker Tools Linux
- Pentest Automation Tools
- Hacking Tools For Windows Free Download
- Ethical Hacker Tools
- Hacker Tools For Ios
- Ethical Hacker Tools
- Pentest Tools For Windows
- Hacking Tools For Pc
- Pentest Tools Website Vulnerability
- Hack Rom Tools
- Pentest Tools Windows
- Nsa Hack Tools Download
- Hack Tools For Windows
- Ethical Hacker Tools
- Hacking Tools For Beginners
- Hacker Tools Windows
- Hacker Tools Software
- Pentest Tools Apk
- Bluetooth Hacking Tools Kali
- What Are Hacking Tools
- Growth Hacker Tools
- Tools 4 Hack
- Usb Pentest Tools
- Pentest Box Tools Download
- Hack Tools
- Hacks And Tools
- Pentest Tools Review
- Hacker Techniques Tools And Incident Handling
- Pentest Automation Tools
- Hacker Tools Software
- Hacking Tools Online
- Tools 4 Hack
- Hacking Tools Windows 10
- Hack Tools Online
- Pentest Tools Find Subdomains
- Hacking Tools And Software
- Hacker Tools For Windows
- Hacker Search Tools
- Hacker Tools For Windows
- Pentest Tools Linux
No comments:
Post a Comment