Aside from adopting enhanced base64- and hexdump-based obfuscation techniques, the updated XCSSET malware has been modified to support the zshrc and dock persistence mechanisms, according to the Microsoft Threat Intelligence team.
Attackers with valid network credentials leveraged Microsoft's certutil app and Windows Remote Management's Remote Shell plugin to facilitate the distribution of the PATHLOADER malware, which then executes the C++-based FINALDRAFT remote administration tool, according to a report from Elastic Security Labs.
After initially focusing on cyberespionage in an attack against a Southeastern European country's foreign ministry in July, threat actors aimed to compromise the Asian firm by exploiting a Palo Alto Networks PAN-OS flaw and pilfering Amazon AWS S3 bucket data and credentials before launching RA World ransomware.
Initial compromise has been followed with either malicious JavaScript code injections for credential theft, LocalOlive web shell delivery for further payload retrieval, or remote access software distribution for additional compromise.
Sandworm, also known as APT44, Seashell Blizzard, and UAC-0113, launched numerous malware intrusions as part of the campaign, the most recent of which involved the distribution of a fake KMS activation tool containing the BACKORDER malware loader that facilitated DarkCrystal RAT delivery following Windows Defender deactivation, according to an EclecticIQ analysis.
