Updated OysterLoader malware uncovered

More sophisticated command-and-control and obfuscation tactics have been integrated into the OysterLoader malware, also known as Broomstick and CleanUp, this year, according to Infosecurity Magazine.

OysterLoader, which is linked to the Rhysida ransomware gang, has been deployed through an updated multi-stage infection chain, which commences with the TextShell packer's in-memory loading of obfuscated shellcode and the use of a bespoke LZMA decompression routine, a report from Sekoia Security showed. Multiple environment checks are then conducted by an intermediate downloader, which also begins C2 communications, before the delivery of the core payload as a DLL. While only two endpoints were previously used by OysterLoader for registration and beaconing, the malware has since pivoted to sending an empty GET request to /api/v2/init, where a fingerprint is also submitted, before beaconing to an assigned endpoint.

OysterLoader's continued advancements signify attackers' high level of commitment, noted researchers. "The quality and complexity of the malware's development strongly suggest that OysterLoader will remain a significant and persistent threat in the near term," said Sekoia.