Threat Intelligence Report November 29 - December 5 2022

Threat name:

Vidar

Threat Actors (TAs) found using the latest variant of stealer malware named Vidar malware to steal credentials from victims’ devices. The Vidar malware was first identified in 2018. It is capable of stealing sensitive data from the victim’s PC, including banking information, saved passwords, IP addresses, browser history, login credentials, and crypto wallets. It then transferred all stolen data to the TAs Command and Control (C&C). Researchers identified that the TAs use delivery mechanisms such as spam mail, cracked software, keygens, etc., to distribute this malware. The malware downloads configuration data from the C&C and other payloads/modules to extract credentials from the victim’s device and perform data exfiltration. 

Mustang Panda (APT)

A notorious advanced persistent threat (APT) group named Earth Preta AKA Mustang Panda or Bronze President used malware families in campaigns and attributed the incidents to them. The APT group targets people using spear-phishing attacks targeting the government, academic, foundations, and research sectors around the world. Based on the lure documents observed in the wild, this is a large-scale cyberespionage campaign that began around March 2022. After months of tracking, the seemingly wide outbreak of targeted attacks includes but is not limited to Myanmar, Australia, the Philippines, Japan, and Taiwan.

LoanBee Fraud App

LoanBee is a fraudulent Android app that steals its users' data. Although the app has been removed from Google Play Store, it has garnered over 100,000 installations. Upon installation, the app will require excessive permissions that will allow it to gather Device Information, Contacts, and Messages and upload it to a remote server.

Xiongmai IoT Exploit

Xiongmai is a Chinese company that manufactures IP Camera/DVR/NVR modules. Through public information, there are approximately 200,000 devices exposed on the public internet. Although, there aren't many reliable public exploit codes available. Information about the firmware used by Xiongmai devices is listed on their Huawei Cloud space. 

Due to the amount of exposed Xiongmai devices, combined with information about their firmware, and the availability of the actual product for purchase, these devices are likely being studied and freely exploited in the wild.

DTrack

DTrack is a backdoor used by the Lazarus group. It allows its users to upload, download, start or delete files on the victim host. Dtrack unpacks the second stage from its PE file. This process has two approaches – offset or resource-based. After retrieving the location of the next stage and its key, the malware decrypts the buffer (with a modified RC4 algorithm) and passes control to it.

Vultur

​​​​​​​Unlike other banking trojans, Vultur uses screen recording based on VNC to obtain all the PII (Personal Identifiable Information). After installation, the dropper uses advanced evasion techniques, including steganography, file deletion and code obfuscation in addition to multiple checks before downloading the malware. 

Upon download, the trojan gives the threat actor a clear view of everything that happens on the compromised device.