Attacks with Stealerium malware spike

Intrusions deploying the Stealerium information-stealing malware have escalated from May to August following an over a year-long lull, reports ITPro.

Threat operation TA2715 led the surge with a campaign involving the spoofing of a Canadian charity in bogus quote requests with attachments that downloaded and executed Stealerium, findings from Proofpoint researchers revealed.

Running the infostealer prompted the subsequent release of 'netsh wlan' commands that enabled Wi-Fi profile and wireless network enumeration. Other attack campaigns that followed entailed the use of hospitality and travel lures, as well as the exploitation of PowerShell and scheduled tasks to compromise Windows Defender and ensure persistence on targeted systems.

Researchers also discovered the use of Stealerium in a campaign that captured desktop screenshots and webcam images from individuals watching adult-themed content for potential sextortion. Organizations have been recommended to track not only 'netsh wlan' activity and dubious Defender exclusions but also the departure of data troves from networks.