A new variant of the Bandook malware has been discovered which targets Windows PCs, so it’s crucial you know how to deal with it.
From its earliest detection in 2007, Bandook has been a capable strain of malware. Being a remote access trojan, Bandook’s main objective has always been to take control of infected PCs. However, following a period of inactivity, the malware has recently started a new campaign aimed at a wide range of industries in different locations. And once Bandook takes control of a compromised PC, it can not only launch further malware attacks, but also steal whatever it wants from the PC.
What is the Bandook Malware Attack?
Bandook’s latest campaign starts with a phishing email, one which uses an infected PDF file. Within this file, there is a link which directs users towards a .7z file – a compressed, archive file. Prompted to enter a password – which is detailed in the original PDF file – to access the .7z archive, the victim will unwittingly activate the malware. Once Bandook is active, it will take advantage of the Msinfo32 application – typically used to collate system data – and edits the Window Registry to remain active on the infected PC.
With Bandook fully established on the victim’s PC, Bandook opens a communication channel with a remote command-and-control server. This allows Bandook to receive further instructions from the threat actors behind the attack. From here, Bandook is able to establish additional malware payloads on the PC, and give full control of the PC over to the remote threat actors. This means that the hackers can steal data, kill active processes on the PC, execute applications, and even uninstall the Bandook malware to cover their tracks if necessary.
How Do You Stay Safe from Bandook?
As with many contemporary threats, Bandook relies on a momentary lapse of judgement from the recipient of their initial email. The impact of a single phishing email can lead to devastating results, so it’s essential your staff understand all the telltale signs of a phishing email. With this information at their fingertips, they’re significantly less likely to unleash malware across your IT infrastructure.
But what else can you do? After all, no organization is 100% secure, and it’s likely your defenses will be breached at some point in the future. Well, you can make sure that you identify a breach and minimize its impact by practicing the following:
- Use anti-malware tools: security suites such as AVG and McAfee represent fantastic tools for protecting your IT infrastructure. As well as carrying out deep scans across your systems for malware, they also feature tools to block malicious websites and can scan files before they’re downloaded to verify their safety.
- Monitor network activity: one of the surest signs of a systems breach is, as featured in the Bandook attack, unusual network activity. Therefore, you should regularly monitor your network activity to identify unusual patterns e.g. prolonged communication with unknown destinations along with downloads from unidentified sources.
For more ways to secure and optimize your business technology, contact your local IT professionals.
Read More