backdoor malware Archives

WarmCookie Malware Serves Up Fake Browser Updates

backdoor malware, compromised websites, fake updates, Ophtek, pop-up prompts, WarmCookiebackdoor malware, compromised websites, fake updates, Ophtek, pop-up prompts, WarmCookieOphtek, LLC

Oct 2024

Cybercriminals are using fake browser updates to spread the WarmCookie backdoor malware in a new campaign targeting users in France.

Browsers are a crucial component of modern business IT and are used almost continuously throughout the day. Whether its placing orders for stock, updating customer portals, or researching your competitors, your employees will be utilizing apps such as Chrome, Edge, and Firefox. And it’s this essential nature of browsers which makes them the perfect target for threat actors. WarmCookie was first detected in 2023, when fake OneDrive attachments were used to deploy its payload, and has recently resurfaced in France. Backdoor attacks have the potential to cause major damage to your IT infrastructures and data security, so it’s vital that you’re aware of how these attacks work.

The Basics of the WarmCookie Attack

The WarmCookie malware campaign targets its victims by concealing itself as fake browser or application updates. When a user visits a compromised website, they’re advised to download what, for all intents and purposes, looks like an update for popular browsers such as Chrome or essential Browser tools like Java. Some of the websites involved in the WarmCookie attack appear to be compromised websites, yet some seem manufactured to promote the downloading of browser updates.

Regardless of the type of website involved, instead of downloading a genuine update, the user will only be able to download the WarmCookie malware. Once this malware is activated, it opens a backdoor into the user’s system, this allows the attackers to carry out a wide range of malicious activities. Primarily, WarmCookie seeks to steal sensitive information such as login credentials, but it also focuses on executing remote commands and downloading further strains of malware onto the infected system.

So far, the campaign appears to have limited its activities to targeting PC users in France. WarmCookie is also renowned for being stealthy and evasive, which enables it to remain undetected on systems for long periods. This allows the attackers to access compromised systems at their own pace, increasing the risk of more severe damage. Therefore, due to this silent and persistent operation, WarmCookie should be classified as a highly dangerous piece of malware.

Avoid the Dangers of Malicious Downloads

Thankfully, you don’t have to become one of WarmCookie’s victims as it’s relatively simple to avoid. With a little education, you can equip yourself and your staff with the best practices to deflect any malicious download threats:

Only Download from Official Sources: it’s paramount that you stick to downloading software, updates, and files from official websites with a direct link from the software’s developer. Third-party or unofficial websites may appear appealing and simple, but they’re often hosting pirated or infected files which could easily contain malware.
Be Wary of Pop-up Update Prompts: pop-up messages are part and parcel of life online in the 21st century, but it’s important that you analyze their content before taking any actions. While they may claim to be linking to a legitimate update, it could very easily be a slice of malware which is on offer. Therefore, always double check by visiting the developer’s website to confirm this update is genuine.
Verify File Integrity: to verify how trustworthy a file is, you can always check its digital signature or file hash to ensure its authenticity. A genuine and valid signature will indicate that the file hasn’t been tampered with by third parties. And file-checking tools – such as VirusTotal – can help you avoid installing infected or manipulated versions of file updates.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Software updates should always enhance your PC’s efficiency, but the recent breach of an ISP has demonstrated quite the opposite.

This recent compromise appears to have been exploited by StormBamboo, a collection of Chinese threat actors who have been causing digital chaos since 2012. The attack was made possible after StormBamboo breached the defenses of an undisclosed ISP. This allowed StormBamboo to take control of the ISP’s traffic and redirect it for their own malicious gains.

If you’re accessing the internet, even if it’s only for basic email and browsing usage, your business is going to be partnered with an ISP. And this attack by StormBamboo tells a cautionary tale of how you always need to be on your guard.

StormBamboo’s Innovative Attack

Having gained unauthorized access to the ISPs servers, StormBamboo was able to intercept and compromise DNS requests from users of that ISP. A DNS request is a query to provide an IP address for a host name – e.g. en.wikipedia.org. An ISP will provide this IP address and allow the user to visit the required webpage.

However, StormBamboo was able to manipulate these DNS requests and, instead of the legitimate IP address, provide a malicious alternative. No action was required from the end user, and they would be transferred to a malicious domain automatically. In particular, StormBamboo focused on poisoning DNS requests for software updates. These updates were insecure as they were found to not validate digital signatures for security purposes.

As a result of these compromises, StormBamboo was able to deceive victims into downloading malware such as Macma (for MacOS machines) and Pocostick (for Windows devices). For example, users of 5KPlayer, a media player, were redirected to a malicious IP address rather than fetching a specific YouTube dependency. This led to a backdoor malware being installed on affected systems. StormBamboo was then observed to install ReloadText, a malicious Chrome extension used to steal mail data and browser cookies.

Staying Safe from StormBamboo

The attacks carried out by StormBamboo appear to have been active during 2023 and were identified by Volexity, a reputable cybersecurity organization. Volexity’s first step was to get in touch with the ISP and identify the traffic-routing devices which were being compromised. This allowed the ISP to reboot its servers and instantly stop the ISP poisoning. Users of the ISP, therefore, were no longer at risk of being exposed to malware. Further advice on eliminating this specific threat can be found on Volexity’s blog.

Nonetheless, businesses are reminded to remain mindful about malicious activity on their networks. Implementing robust security measures, conducting regular vulnerability assessments, and monitoring network traffic for unusual patterns are all crucial. Additionally, employing advanced threat detection tools and training employees on cybersecurity best practices will further strengthen your defenses. Finally, never forget the importance of keeping software and systems updated with official patches, firmware, and updates.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Russian hackers are using a fake PDF decryption tool to trick innocent PC users into downloading Spica, a new strain of malware.

Discovered by Google’s Threat Analysis Group (TAG), Spica is a backdoor malware which has not been identified previously. It’s believed that the malware is the result of ColdRiver, a Russian hacking team with a proven track record in deploying malware. The attack, as with so many contemporary threats, is delivered by email and relies on malicious PDF files. Now, with close to 350 billion emails sent per day in 2023, it’s clear that email is hugely popular. And it’s estimated there are 2.5 trillion PDF files currently in circulation. Therefore, the chances of your business running into a similar attack is high.

The Threat of Spica

The Spica attack begins when the threat actors send a series of PDF files to their targets. Using phishing email techniques, they attempt to trick the targets into believing that these have been sent by legitimate contacts. These files appear encrypted and, if the target bites, they will email back to say they can’t open the files. This is where the threat actors are able to launch their payload.

By sending a malicious link back to the target, the threat actors can trick them into downloading what they claim is a decryption tool. However, this executable tool – going under the name of Proton-decryptor.exe – is far from helpful. Instead, it will provide backdoor access to the target’s PC. With this access in place, the malware can communicate with a control-and-command server to receive further instructions.

And Spica comes loaded with a wide range of weaponry. As well as being capable of launching internal shell commands on the infected PC, it’s also programmed to steal browser cookies, send and receive files, and create a persistent presence on the machine. Google believes that there are multiple variants of Spica, and the current targets of the malware seem to be high ranking officials in non-governmental organizations and former members of NATO governments.

Shielding Yourself from the Threat of Spica

While your organization may not be listed high on ColdRiver’s target list, the attack methods are familiar and could easily be launched against you at some point in the future. Therefore, it’s in your best interests to integrate the following advice into your cybersecurity measures:

Always double check attachments: with email attachments representing one of the surest ways to transmit malware, it’s vital you remain vigilant. If you have even the slightest inkling that something seems suspicious with an email from a known contact, don’t email them back. Instead, contact them by phone to confirm the email is genuine, as it may be that their email account has been hacked.

Check for spelling/grammar errors: phishing emails are prone to poor grammar and spelling, especially when they originate from non-English speakers. Accordingly, poorly composed emails should be scrutinized closely. Also, watch out for generic and unusual greetings such as “Dear customer” as these may indicate that the email is part of a mass-campaign against unknown targets.

Use email filters: by using email filters, often included with anti-malware software such as McAfee, you can provide your organization with an extra layer of security. Connected to databases which are regularly updated, these email filters can identify malicious files before they’re downloaded to your PC.

For more ways to secure and optimize your business technology, contact your local IT professionals.

WarmCookie Malware Serves Up Fake Browser Updates

Poisoned Software Updates Issued after ISP is Hacked

Spica: New Malware Launched by Russian Hackers

Category Archives: backdoor malware