Malware

Malicious apps spoofing the Google Chrome, Google Play Store, and Android Security apps have been leveraged to lure targets into downloading DroidBot Android banking trojan, which not only enables keystroke logging and fake login page overlaying but also facilitates the interception of incoming text messages.

After achieving initial access to a Storm-0156 C2 server in December 2022, Turla sought to take over more of the Pakistani threat operation's C2s to compromise Afghan government organizations' networks with the TwoDash downloader and Statuezy trojan.

The site, which has been in operation since 2012, boasted over 100 vendors and 100,000 customers, facilitating illegal transactions in cryptocurrencies like Bitcoin and Monero.

While attacks initially involved the distribution of a malicious HTML app that facilitated retrieval of a script enabling NetSupport RAT malware deployment, threat actors shifted to impersonate Next.js and other JavaScript libraries to deliver NetSupport RAT and BurnsRAT, according to an analysis from Kaspersky.

Additional details were not provided by Signzy, which noted enlisting a "professional agency" to investigate the intrusion. However, PayU, which is one of its clients, disclosed the former to have been compromised with "information stealer malware" while emphasizing the security of its systems.

Bootkitty has been integrated with a manipulated BMP file exploiting LogoFAIL-related vulnerability, tracked as CVE-2023-40238, to circumvent defenses provided by Secure Boot, compromise UEFI image parsing routines, and execute malicious bootloaders, according to a separate report from Binarly.

Threat actors commenced attacks by distributing phishing emails with a malicious Microsoft Excel file, which leverages the CVE-2017-0199 and CVE-2017-11882 vulnerabilities to deliver the Ande Loader, according to an analysis from Fortinet FortiGuard Labs.