New Storm-0249 attacks harness EDRs for covert malware compromise

BleepingComputer reports that initial access broker Storm-0249 has moved to exploiting SentinelOne endpoint detection and response to facilitate stealthier attacks after initially launching widespread phishing intrusions.

Malicious curl commands pasted and executed in the Windows Run dialog following successful ClickFix lures enable the installation of an illicit MSI package with SYSTEM privileges, as well as a nefarious PowerShell script, with the former placed alongside the SentinelOne EDR's SentinelAgentWorker.exe file, a report from ReliaQuest showed.

After using the signed executable to side-load the DLL and obtaining access, threat actors proceed to gather system identifiers from Windows utilities, while funneling encrypted HTTPS command-and-control traffic. All impacted systems have been profiled with the hardware-based identifier 'MachineGuid,' which has been leveraged by the ALPHV and LockBit ransomware gangs for encryption key binding.

Such abuse of trusted EDR processes necessitates the implementation of behavior-based detection, as well as more robust curl, PowerShell, and LoLBin execution controls.