Malware

Malicious ads with time-limited offers and countdowns have been leveraged by threat actors to lure downloads of the predatory loan apps, which would seek unneeded permissions for SMS, contact, call record, phone storage, calendar, microphone, and camera access, which would then be used for extortion and contact spamming in the event a loan payment is missed.

Such a development comes months after Banshee Stealer was reported by Elastic Security Labs to enable extensive system, cryptocurrency wallet, browser, and browser extension data compromise although its serious data exfiltration capabilities have been watered down by its less advanced composition.

After achieving initial network access through the exploitation of Ivanti Connect Secure VPN, Fortinet FortiClient EMS, Sophos Firewall, and Microsoft Exchange vulnerabilities, Salt Typhoon proceeds with the deployment of GhostSpider, which ensures stealth through its expansive module command support, and other backdoors.

Malware leverages a legitimate – but outdated – Avast kernel driver, which lets it evade defenses and wreak havoc on systems.

TAG-110 leveraged vulnerable internet-exposed web apps and phishing emails to facilitate the delivery of the HATVIBE app loader that triggers that data exfiltrating CHERRYSPY backdoor.

The packages were installed more than 1,700 times each prior to their removal from the repository.

Attacks with Wolfsbane commence with the deployment of the 'cron' dropper delivering the KDE desktop component-spoofing launcher, which deactivates SELinux and alters user configuration files before triggering the privacy malware component that has file operation, data theft, and system manipulation command support, an analysis from ESET revealed.