miércoles, 17 de enero de 2024

SolarMarker Malware Uses Novel Techniques To Persist On Hacked Systems

 In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.

Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.

Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.

Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.

The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.


"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.

The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.

"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."

What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.

The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.

"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."

Related word
  1. Pentest Tools List
  2. Hacking Tools Windows
  3. Hacker Tools Software
  4. Physical Pentest Tools
  5. Hacker
  6. New Hacker Tools
  7. Hack Tools Github
  8. Hacker Tools Apk Download
  9. Hack Tools Github
  10. Hacker Security Tools
  11. Hacking Tools 2019
  12. Black Hat Hacker Tools
  13. How To Make Hacking Tools
  14. Hacker Tools 2019
  15. Pentest Tools Subdomain
  16. Hacking Tools For Pc
  17. Pentest Tools Tcp Port Scanner
  18. Nsa Hacker Tools
  19. Hacker
  20. Hacking Tools For Games
  21. Pentest Recon Tools
  22. Hack Apps
  23. Hak5 Tools
  24. Hacker Tool Kit
  25. Tools Used For Hacking
  26. Hacker Techniques Tools And Incident Handling
  27. Tools 4 Hack
  28. Pentest Tools Find Subdomains
  29. Pentest Recon Tools
  30. Hack Tools Pc
  31. Pentest Tools Framework
  32. How To Hack
  33. Hacking Apps
  34. Hacking Tools For Kali Linux
  35. Usb Pentest Tools
  36. Hack Tool Apk
  37. Hacker Tool Kit
  38. Hack Tools For Mac
  39. Hack Tools Github
  40. Pentest Tools Github
  41. Ethical Hacker Tools
  42. Hacking Tools Online
  43. Pentest Tools Framework
  44. Hack Tools Mac
  45. Hacker Tools 2019
  46. Tools Used For Hacking
  47. Hack Tools For Games
  48. Hackers Toolbox
  49. Hack Tools 2019
  50. Hacking Tools Github
  51. Hacker Tools For Ios
  52. Ethical Hacker Tools
  53. Best Pentesting Tools 2018
  54. Pentest Tools Linux
  55. Tools For Hacker
  56. Blackhat Hacker Tools
  57. Hacker Tools 2020
  58. Hackrf Tools
  59. Hacker Tools Free
  60. Pentest Tools Github
  61. Android Hack Tools Github
  62. Best Hacking Tools 2019
  63. Pentest Tools For Windows
  64. Physical Pentest Tools
  65. Install Pentest Tools Ubuntu
  66. Pentest Tools Kali Linux
  67. Hacking Tools Pc
  68. Hacking Tools For Games
  69. Hacking Tools Online
  70. Hack Tools Online
  71. Hacker Tools Hardware
  72. Hacking Tools For Games
  73. Hack Tools
  74. Best Hacking Tools 2020
  75. Hack Tools For Ubuntu
  76. Pentest Tools Website Vulnerability
  77. Hacking Tools For Windows 7
  78. Hacker Tools 2020
  79. Hacker Tools Windows
  80. Pentest Tools Bluekeep
  81. Hacking Tools For Kali Linux
  82. Hacking Tools
  83. Hacking Tools Github
  84. Hacking Tools Software
  85. New Hack Tools
  86. Hack App
  87. Pentest Tools Port Scanner
  88. Pentest Recon Tools
  89. Tools For Hacker
  90. How To Make Hacking Tools
  91. Pentest Tools Url Fuzzer
  92. Hack Tools Github
  93. Hack Tools 2019
  94. Hack Tools
  95. Github Hacking Tools
  96. Best Pentesting Tools 2018
  97. Pentest Tools Online
  98. Computer Hacker
  99. Hack Tool Apk No Root
  100. Pentest Tools For Mac
  101. Hack Tools For Ubuntu
  102. Hacker Tools
  103. Pentest Tools Framework
  104. Install Pentest Tools Ubuntu
  105. Android Hack Tools Github
  106. Hacker Hardware Tools
  107. Hack Tool Apk No Root
  108. Hack Tools Pc
  109. Hack And Tools
  110. Hack Tools For Pc
  111. Pentest Tools Alternative
  112. Best Pentesting Tools 2018
  113. Free Pentest Tools For Windows
  114. Hacker Tools For Windows
  115. Github Hacking Tools
  116. Hacking Tools Pc
  117. Easy Hack Tools
  118. Computer Hacker
  119. Hacking Tools Windows
  120. Hacker Tools Online
  121. Github Hacking Tools
  122. Pentest Tools List
  123. Hacker Tools 2020
  124. Free Pentest Tools For Windows
  125. Ethical Hacker Tools
  126. Pentest Reporting Tools
  127. Hacking Tools Download
  128. Hacker Search Tools
  129. Hacking Tools For Games
  130. Hacker Tools Apk Download
  131. Tools Used For Hacking
  132. Usb Pentest Tools
  133. Hak5 Tools
  134. How To Install Pentest Tools In Ubuntu
  135. Pentest Tools Port Scanner
  136. Hack App
  137. Bluetooth Hacking Tools Kali
  138. Nsa Hacker Tools
  139. How To Make Hacking Tools
  140. Hacker Techniques Tools And Incident Handling
  141. Pentest Recon Tools
  142. Pentest Tools Subdomain
  143. Hack Tools Download
  144. Hacker Tools For Pc
  145. Pentest Box Tools Download
  146. Underground Hacker Sites
  147. Pentest Tools Linux
  148. Hacking Tools For Windows 7
  149. Pentest Tools Github
  150. Hacker Tools List
  151. Hack Tools For Ubuntu
  152. Hack Tools For Pc
  153. What Is Hacking Tools
  154. Hack Tools
  155. How To Make Hacking Tools
  156. Beginner Hacker Tools

No hay comentarios: