This advanced new malware strain leaves you practically defenceless

An extremely potent malware, delivered in a way that’s immune to most cybersecurity measures, was discovered infecting high-profile Chines...

An extremely potent malware, delivered in a way that’s immune to most cybersecurity measures, was discovered infecting high-profile Chinese individuals. 

Cybersecurity researchers from Kaspersky have discovered malware they call WinDealer, distributed and used by a Chinese Advanced Persistent Threat (APT) actor called LuoYu. WinDealer, the researchers say, is capable of collecting “an impressive amount” of information. It can view and download any files stored on the device, as well as run a keyword search on all the documents.

To deliver the malware to the target endpoint, the attackers perform a man-on-the-side attack, essentially hijacking in-transit network traffic.

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.

Racing with the server

When the victim tries to access a certain resource on the internet (for example, open their LinkedIn account), they need to send a request to the server, to open the page. This request is the type of traffic that the attackers can intercept and read, and then try to deliver malicious content before the server responds with the legitimate site.

Kaspersky describes the method as a “race” with the legitimate server, the only difference being - the attacker has as many attempts to deliver malicious content as they want. In order to successfully infect a target endpoint, the attacker needs no interaction with the victim, whatsoever.

Targets are mostly high-profile organizations and individuals in China, the researchers further claim. Foreign diplomatic organizations established in China, members of the academic community, defense, logistics, and telecommunications companies, are all listed as potential targets. Besides China, Kaspersky researchers have also mentioned targets in Germany, Austria, the US, the Czech Republic, Russia, and India.

All of the targets are using Windows as their operating system of choice.

Besides being difficult to spot, the malware is also difficult to block. Usually, this type of malware contacts a command & control (C2) server for instructions, and simply blocking the IP address of the server would be enough to neutralize the threat. WinDealer, on the other hand, relies on a complex algorithm that generates IP addresses (48,000, Kaspersky says), making blocking impossible. 

The only way to defend against such an attack is to route the traffic through another network, for example with a VPN. However, having a VPN in China is easier said than done. 

from TechRadar - All the latest technology news https://ift.tt/DE1dxkP



Apps,3856,Business,149,Camera,1155,Earn $$$,2,Gadgets,1740,Games,926,GTA,1,Innovations,2,Mobile,1696,Paid Promotions,4,Promotions,4,Technology,7935,Trailers,796,Travel,37,Trendly News,23996,Video,5,XIAOMI,13,
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews: This advanced new malware strain leaves you practically defenceless
This advanced new malware strain leaves you practically defenceless
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share. STEP 2: Click the link you shared to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy