Morphisec researchers noted that the new delivery chain uses the Nitro Pro PDF application, commencing with the distribution of a more than 100 MB MSI installer payload, which uses the Advanced Installer app for obfuscation and enables threat actors to evade anti-malware engines.
Infosec teams struggle to detect Linux-based threats such as Vermillion Strike due to an overemphasis on Windows malware, a lack of effective solutions for protecting data centers, and the immaturity of sandboxes.
In separate reports Thursday, Akamai detailed two threats: One new, complex miner targeting WordPress, and a Linux miner that just learned to speak Windows.
Adversaries use the storage mechanism as a way to hide second-stage malware payloads, knowing that "no one in security really knows the exact structure of these files except Microsoft, said one security expert.
