New memory malware discovered

[Kloudkicker 4,565]

~ Hackers-For-Hire Group Develops New 'PowerPepper' In-Memory Malware~  https://amp.thehackernews.com/thn/2020/12/hackers-for-hire-group-develops-new.html: by Ravie Lakshmanan on 04 Dec, 2020

Partial quote-

"Cybersecurity researchers on Thursday disclosed details of a previously undiscovered in-memory Windows backdoor developed by a hacker-for-hire operation that can execute remotely malicious code and steal sensitive information from its targets in Asia, Europe, and the US.

Dubbed "PowerPepper" by Kaspersky researchers, the malware has been attributed to the DeathStalker group (formerly called Deceptikons), a threat actor that has been found to hit law firms and companies in the financial sector located in Europe and the Middle East at least since 2012.

The hacking tool is so-called because of its reliance on steganographic trickery to deliver the backdoor payload in the form of an image of ferns or peppers.

The espionage group first came to light earlier this July, with most of their attacks starting with a spear-phishing email containing a malicious modified LNK (shortcut) file that, when clicked, downloads and runs a PowerShell-based implant named Powersing...     among them are the capabilities to hide malicious execution workflow in Word embedded shape and object properties and use Windows Compiled HTML Help (CHM) files as archives for malicious files... 

Multiple mercenary groups have been seen in the wild before, including BellTroX (aka Dark Basin), Bahamut, and CostaRicto, all of whom have deployed custom malware to breach systems belonging to financial institutions and government officials.

"It only seems fair to write that DeathStalker tried hard to develop evasive, creative and intricate tools with this PowerPepper implant and associated delivery chains," Delcher concluded.

"There is nothing particularly sophisticated about the techniques and tricks that are leveraged, yet the whole toolset has proved to be effective, is pretty well put together, and shows determined efforts to compromise various targets around the world."

To safeguard against PowerPepper delivery and execution, it is recommended that businesses and users update their CMS backends as well as associated plugins, restrict PowerShell use on end-user computers with enforced execution policies, and refrain from opening Windows shortcuts attached to emails, or click links in emails from unknown senders."

More info at link above.

Stay safe.

[TheMurderousCricket 5,113]

Makes me more and more happy with the purchase of an air-gapped computer.

Kind of sad though when you consider what the Internet has become. For me personally, the people who write ransomware are the absolute scum and worthless POS. Compared to that, data-stealing and CPU-jacking is not as serious in consequences and losses.