$type=slider$show=home$snippet=hide$cate=0$h=500$va=0$rm=0

Dangerous new malware dances past more than 50 antivirus services

Researchers have discovered a new malware sample capable of hiding from more than 50 antivirus products available on the market right now...

Researchers have discovered a new malware sample capable of hiding from more than 50 antivirus products available on the market right now.

The malware was discovered by cybersecurity researchers from Unit 42, the threat intelligence team at Palo Alto Networks. The team first spotted the strain in May, when it discovered that it was built using the Brute Ratel (BRC4) tool. 

BRC4’s developers claim to have even reverse-engineered popular antivirus products, to make sure their tool avoids detection.

The quality of the design and the speed at which it was distributed between the victims' endpoints has convinced the researchers that a state-sponsored actor is behind the campaign.

Russian methods

While the tool itself is dangerous, the researchers were more interested in its distribution path, which indicates a state-sponsored actor is in play.

The malware is being distributed in the form of a fake CV document. The CV is an ISO file that, once mounted onto a virtual drive, displays something resembling a Microsoft Word document.

While the researchers still can’t pinpoint exactly who the threat actor behind BRC4 is, they suspect Russian-based APT29 (AKA Cozy Bear), which has used weaponized ISOs in the past.

Another hint suggesting that a state-sponsored actor is in play is the speed at which BRC4 was leveraged. The ISO was created the same day the latest version of BRC4 was published.

"The analysis of the two samples described in this blog, as well as the advanced tradecraft used to package these payloads, make it clear that malicious cyber actors have begun to adopt this capability," Unit 42 wrote in a blog post.

"We believe it is imperative that all security vendors create protections to detect BRC4 and that all organizations take proactive measures to defend against this tool." 

Via: The Register



from TechRadar - All the latest technology news https://ift.tt/vLSBCkz
via IFTTT

COMMENTS

BLOGGER
Name

Apps,3856,Business,149,Camera,1155,Earn $$$,2,Gadgets,1740,Games,926,GTA,1,Innovations,2,Mobile,1696,Paid Promotions,4,Promotions,4,Technology,7935,Trailers,796,Travel,37,Trendly News,24180,Video,5,XIAOMI,13,
ltr
item
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews: Dangerous new malware dances past more than 50 antivirus services
Dangerous new malware dances past more than 50 antivirus services
Trendly News | #ListenNow #Everyday #100ShortNews #TopTrendings #PopularNews #Reviews #TrendlyNews
http://www.trendlynews.in/2022/07/dangerous-new-malware-dances-past-more.html
http://www.trendlynews.in/
http://www.trendlynews.in/
http://www.trendlynews.in/2022/07/dangerous-new-malware-dances-past-more.html
true
3372890392287038985
UTF-8
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share. STEP 2: Click the link you shared to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy