Google releases security checklist

Aside from exploiting a domain generation algorithm and conducting environment checks to prevent execution on other systems, the newly discovered Zloader variant has also been spread through the GhostSocks payload as part of an updated attack chain, a report from Zscaler ThreatLabz showed.

Attacks involved the exploitation of open-source and living-off-the-land tactics previously associated with Chinese advanced persistent threat groups, including the Rakshasa and Stowaway reverse proxy programs, the PlugX remote access trojan, and custom DLL files enabling login credential exfiltration, according to an analysis from the Symantec Threat Hunter Team.

After tapping Russian threat operation Storm-1837's backdoor to facilitate Tavdig loader compromise in January, Turla proceeded to leverage Storm-1919's Amadey botnet to distribute the XMRig cryptominer between March and April, according to an analysis from the Microsoft Threat Intelligence team.