More sophisticated JSCEAL malware emerges

Improved anti-analysis methods and a more robust command-and-control infrastructure have been embedded in an upgraded version of the JSCEAL information-stealing malware in use since August, according to GBHackers News.

While JSCEAL initially used multi-word, hyphenated C2 domain names with consistent .com top-level domains, the infostealer had shifted to single-word domain names with various TLDs, while adopting more stringent access control filters, reported Cato CTRL researchers. Apart from providing HTTP 404 responses to requests without PowerShell User-Agent headers and serving a bogus PDF file for malware delivery to legitimate PowerShell requests, the updated JSCEAL malware has also tapped COM object interactions for Windows Scheduler in lieu of hardcoded scheduled tasks.

However, JSCEAL's improvements have not concealed patterns associated with the malware, with Cato researchers determining PowerShell-based C2 communications and staged PDF validation routines. Such findings should prompt an increased focus on cloud-based threat discovery, network visibility, and behavioral detection, researchers added.