In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.
Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.
Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.
Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.
The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.
"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.
The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.
"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."
What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.
The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.
"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."
More info
- Hacker Tools Apk Download
- Hack Tools For Pc
- Github Hacking Tools
- Best Hacking Tools 2019
- Pentest Tools Alternative
- Blackhat Hacker Tools
- Hack Tools Github
- How To Make Hacking Tools
- Free Pentest Tools For Windows
- Hack App
- Pentest Tools Find Subdomains
- How To Make Hacking Tools
- Hacking Tools For Mac
- Pentest Tools Review
- Hacker Tools Free Download
- Tools Used For Hacking
- Hack Tools Online
- What Are Hacking Tools
- Hacking Tools For Beginners
- Nsa Hack Tools Download
- New Hack Tools
- Pentest Tools Download
- Hacking Tools For Windows
- Hak5 Tools
- Hacks And Tools
- Hacker Tools Online
- Hack Rom Tools
- Hacker
- Hack App
- Best Hacking Tools 2020
- Pentest Tools Port Scanner
- Hacker Tools For Pc
- Pentest Recon Tools
- Hack Tools Pc
- Pentest Tools Subdomain
- Nsa Hack Tools
- Wifi Hacker Tools For Windows
- Hacking Tools Online
- Pentest Tools Nmap
- Hacking Tools Pc
- Hack Tools For Ubuntu
- Hak5 Tools
- What Is Hacking Tools
- New Hack Tools
- Hacker Tools Windows
- Hack Tools Pc
- Hack Tools Download
- Pentest Tools For Ubuntu
- Hacker Tools For Mac
- Hackrf Tools
- New Hack Tools
- Hacker Tools Github
- Hacking Tools
- Hacker Tools Apk
- Hacking App
- Hacking Tools Free Download
- What Is Hacking Tools
- Hacking Tools Online
- Hack Tools For Ubuntu
- Hacker Tools Mac
- Hacking Tools Windows
- Pentest Recon Tools
- Hack Tools
- Hacker Tools Apk Download
- Hacking Tools 2020
- Android Hack Tools Github
- Bluetooth Hacking Tools Kali
- Physical Pentest Tools
- Wifi Hacker Tools For Windows
- Blackhat Hacker Tools
- Hack Tools For Ubuntu
- Best Hacking Tools 2019
- New Hacker Tools
- Tools For Hacker
- Hacker Tools Free Download
- Pentest Tools Linux
- Install Pentest Tools Ubuntu
- Hacker Tools
- Hacker Tools Windows
- Black Hat Hacker Tools
- Hacker Tools List
- Hacking Tools Download
- Hacker Tools Hardware
- Hacking Tools 2020
- Hack Tools Pc
- Hack Tools Online
- Hacker Tools
- Wifi Hacker Tools For Windows
- Pentest Tools Free
- Pentest Tools For Ubuntu
- Hack Tools Pc
- Pentest Tools Linux
- Hack App
- Hack Tools
- Hack Website Online Tool
- Hacking Tools Usb
- Pentest Tools Website
- Hacking App
- Hack Tools For Mac
- Hack Tool Apk
- Best Hacking Tools 2019
- Hacker Tool Kit
- Hacking Tools For Pc
- Pentest Tools Linux
- Black Hat Hacker Tools
- Nsa Hacker Tools
- Hacking Tools For Pc
- Black Hat Hacker Tools
- Top Pentest Tools
- Pentest Tools Github
- Pentest Tools For Windows
- Hack Rom Tools
- Hacks And Tools
- Hacker Hardware Tools
- Pentest Tools Subdomain
- Pentest Tools Framework
- Hackers Toolbox
- Hacker Tools Online
- Hack Tools Github
- Hacking Tools And Software
- Hacking Tools Usb
- How To Hack
- Pentest Tools Tcp Port Scanner
- Hacker
- Black Hat Hacker Tools
- Hack Tools Pc
- Pentest Box Tools Download
- Hack Tools For Games
- Tools Used For Hacking
- Hack Tool Apk
- How To Make Hacking Tools
- Pentest Tools Port Scanner
- Pentest Tools Review
- Tools For Hacker
- Hacker Tools
- Pentest Tools Free
- Pentest Tools List
- Hacking Tools For Windows 7
- Hacking Tools Pc
- Hack Tools For Games
- Hacking Tools Windows
- Hacker Hardware Tools
- Hacker Tools For Pc
- Termux Hacking Tools 2019
- Hacker Tools 2020
- Best Hacking Tools 2020
- Hacker Tools Windows
- Hacker Tools For Ios
- Hacker Tools Hardware
- Hacker Tools For Mac
- Hacking Tools Github
- Pentest Tools Windows
- Pentest Tools Apk
- Hack Rom Tools
- Hacking Tools For Pc
- Hacker Tools For Pc
No comments:
Post a Comment