Updated CountLoader, nascent GachiLoader payloads examined

Fake software distribution sites and hacked YouTube accounts have been leveraged to spread the upgraded CountLoader and novel GachiLoader malware loaders, respectively, The Hacker News reports.

Intrusions deploying CountLoader commenced with the redirecting of users attempting to download cracked versions of Microsoft Word and other legitimate software to a MediaFire link with an illicit ZIP archive that facilitates the execution of the loader, according to an analysis from the Cyderes Howler Cell Threat Intelligence team.

After ensuring persistence and verifying the presence of CrowdStrike Falcon in the targeted system, CountLoader proceeds to self-propagate in removable USB drives, pilfer system information, download a DLL and MSI installer, and retrieve and execute the ACR Stealer.

Another report from Check Point research detailed the use of the YouTube Ghost Network composed of various breached YouTube accounts to deliver the newly emergent GachiLoader malware loader, which had versions deploying the Kidkadi malware and the Rhadamanthys infostealer.