Malware

The fileless script injection is difficult to detect using traditional scanning methods.

Attacks by RedDelta commence with spear-phishing emails using Mongolian flood protection, Taiwanese presidential candidate Terry Gou, and an Association of Southeast Asian Nations meeting as lures that contain malicious MSI, MSC, and LNK files to facilitate PlugX malware compromise, according to an analysis from Recorded Future's Insikt Group.

Executing the bogus exploit — which is based on the legitimate PoC created by SafeBreach Labs but contains the UPX-packed poc.exe file — launches a PowerShell script in the targeted system's %Temp% folder that establishes a script-executing scheduled job to facilitate the eventual retrieval of the infostealing payload, according to a Trend Micro analysis.

Intrusions discovered earlier this week commenced with the delivery of a malicious email purporting to be from a CrowdStrike employment agent that includes a link for downloading an employee CRM app, which when clicked redirected to a CrowdStrike-spoofing website offering Windows and macOS versions of the app, according to CrowdStrike.

Any sense that macOS computers are immune from attacks is a farce, say security researchers.

Included in the discovered web shells were China Chopper — which is a fixture among advanced persistent threat operations — c99shell, and r57shell, as well as a backdoor that integrated Lazarus Group-like capabilities, according to a report from WatchTowr Labs.

After performing client app initialization, NonEuclidRAT — which has been proliferating in the dark web since late November — conducts detection bypass checks and establishes a TCP socket while adding Microsoft Defender Antivirus exclusions and leveraging Windows API calls for process enumeration.

Hackers have set up a botnet based on exploitation of zero day in Four-Faith industrial routers.