A well-known malware is making new rounds online, abusing Microsoft’s digital signature verification to steal passwords and other sensitive information from its victims.
According to cybersecurity researchers from Check Point Research (CPR), who spotted the new campaign, the ZLoader malware was most recently used to distribute the Conti ransomware several months ago.
This time around, however, ZLoader is the final payload, while the goal of the campaign is to steal sensitive data, not encrypt the devices.
Sneaky insertion
The distribution process is nothing out of the ordinary, CPR explains. First, the victim installs a remote management program “pretending to be a Java installation” when, in fact, it grants the attackers full access to the system, and allows them to upload and download files, as well as run scripts.
The attackers then “upload and run a few scripts, that download more scripts that run mshta.exe with file appContrast.dll as the parameter”.
The file appContrast.dll is signed by Microsoft, even though more information has been added to the end of the file, CPR explains, adding that this added information downloads and runs the final ZLoad payloader which steals passwords and other sensitive data.
Thousands of victims
CPR claims that the malware had been installed on more than 2,000 devices across 111 countries, with the majority of victims being in the United States, Canada, and India.
CPR believes that the cybercrime group behind the campaign is called MalSmoke, “given a few similarities with previous campaigns”, it said.
“We first began seeing evidence of the new campaign around November 2021,” said Kobi Eisenkraft, Malware Researcher at Check Point. “All in all, it seems like the Zloader campaign authors put great effort into defense evasion and are still updating their methods on a weekly basis. I strongly urge users to apply Microsoft’s update for strict Authenticode verification, It is not applied by default.”
Besides applying Microsoft’s update for strict Authenticode verification, which is not applied by default, Check Point Research also reminds everyone to be mindful when installing programs from unknown sources or sites. And finally, to be vigilant when clicking on links or opening email attachments, as these are often malicious.
- You might also want to check out our list of the best endpoint protection services right now
