Ukjente nettkriminelle angrep selskaper relatert til den amerikanske oljeindustrien ved å bruke Adwind-trojaneren (andre navn jRAT, AlienSpy, JSocket og Sockrat). RAT Adwind, som ble brukt som en del av en ondsinnet datatyverikampanje, ble tidligere brukt mot selskaper i elektrisitetssektoren.
ENccording to researchers from Netskope, Dens evner til å ta opp lyd og kontrollere webkameraet mens de utfører tradisjonell informasjonstyveri, ber om å holde et godt øye med det are carried out from a domain belonging to Australian Internet provider Westnet. It remains unclear whether the group members are Westnet customers or they have compromised their customer accounts and use them to distribute Adwind.“We found multiple RAT samples hosted on the serving domain and spread across multiple directories, all hosted within the last month. The attacker is either a Westnet user or has compromised the account of one or more Westnet users. The same RAT is being hosted by multiple other Westnet users”, — report Netskope researchers.
Adwind RAT is offered on a number of trading platforms on the darknet, Ifølge malware-as-a-service modell, and over the past two years has been used repeatedly in various campaigns.
The malware is able to encrypt and filter data, capture webcam images, check hard drives for the presence of certain files based on extensions in the malware configuration, inject malicious code into legitimate processes to avoid detection and monitor the state of the system. The software modifies registry settings to ensure persistence and can disable firewalls, antivirus solutions, and other security services on infected devices.
Les også: Gratis Windows Rat Trojan NanoCore kan føre Outbreak
ifølge forskere, in a new version of Adwind, criminals implemented complex methods of obfuscation. An analysis of the malware showed that it uses several built-in JAR archives (Java Archive) before unpacking the final payload. The obfuscation level was so effective that bare 5 ut av 56 Antivirus solutions on VirusTotal could detect malware.
“The Adwind RAT is a well-known malware family that has actively been used in multiple campaigns over the last couple of years. The samples we analyzed showed that the VirusTotal detection ratio for the top-level JAR was 5/56 while that of the final decrypted JAR was 49/58. These detection ratios indicate that attackers have largely been successful in developing new, innovative obfuscation techniques to evade detection”, — emphasize Netskope developers.
I følge analysen, the attackers are primarily interested in documents, files and other locally stored data. They are also interested in finding information such as FTP passwords and SSH keys, which can give more access to the network.
