Blogs by Ashwin

  To know more about it, you can go through my detailed document by clicking  here Overview Backdoor.Oldrea, as the name suggests, is a backdoor used by Dragonfly to target energy companies since 2013. It spreads through supply chain compromise and also contains special modules to enumerate as well as map ICS-specific systems, processes, and protocols. It's a Remote Access Trojan (RAT) and can easily communicate with Command and Control (C2) server, that deploys payloads and offers additional functionality. Techniques Used Some of the techniques used by the malware are: Automated Collection- Collects the information about the connected devices and send them to the server for the threat actors to analyze.  Denial of Service- Sudden crash of the various OPC platforms may lead to the denial of service impact on the applications. Spearphishing Attachment- The malware can easily spread via the emails containing the malicious links or attachments. Point & Tag Identification...

  To know more about it, you can go through my detailed document by clicking  here Overview BackConfig is a trojan having a flexible plugin architecture that has been used by Patchwork APT. It's a complex hacking tool, generally deployed against the high-value targets of South-Asian region. How Does It Works? This malware generally spreads through spear-phishing emails, in which, the fake content seems relevant to the target preferences and once it successfully tricks the target, the system will be infected by BackConfig malware. Recently, a combination of text files and batch scripts was used to eventually download the BackConfig payload via a remote URL. After that, this malware can easily gather system information, download additional payloads, keylogging, etc. and use them for their malicious purposes.. Impact Information theft and exposure of sensitive data are some of the major impacts of BackConfig infection. Prevention Following steps might help in mitigating this malw...

  To know more about it, you can go through my detailed document by clicking  here Overview BabyShark is a Microsoft Visual Basic (VB) script-based malware family, that is linked with various North Korean campaigns, uses the same infiltration techniques as the KimJongRAT and STOLEN PENCIL, and spreads via spear phishing emails.  How Does it Works? Firstly, the malware will execute the Microsoft Visual Basic script containing a malicious MS Excel file that will help it in giving the commands to look for user information, system information, system name, IP address, running tasks, etc. The acquired information is then encrypted by the BabyShark malware and sent to the C&C server. It is speculated that the main goal of this malware is to gather the intelligence regarding the national security issues of Northeast Asia.  Prevention In order to secure your system against BabyShark malware you can: Be careful of the spear phishing campaigns especially preferred by North...

  To know more about it, you can go through my detailed document by clicking  here Overview Babuk, a Ransomware-as-a-Service (RaaS) malware identified in 2021, employs a "Big Game Hunting" approach to target major enterprises and works as a leak site to post stolen data that can be used in their extortion scheme. However, it isn't considered as a sophisticated malware because of its many flaws like bugs and non-obfuscated file codes, but, it despite of these glitches, it has managed to corrupt many files beyond repair and published stolen data on the internet as well as the dark web. How Does it Spreads? Alike the other RaaS products, Babuk also uses same techniques to exploit a system, i.e.: Email Phishing- They also uses emails to spread the malware to a victim's computer. Common Vulnerabilities & Exposures (CVEs)- It can easily exploit various CVEs targeting the popular software.  Remote Desktop Protocol (RDP)- The poorly protected RDP access may also result in...

  To know more about it, you can go through my detailed document by clicking  here Overview Azorult, a commercial trojan that steals sensitive information from the compromised systems and send it to the C&C server, was observed in 2016 and targeted the North American users via a spearphishing campaign in July 2018. It can collect various data like, browser history, login credentials, cookies, cryptowallet files, etc.  How Does it Works? As the malware spreads via spearphishing email campaigns that contains malicious attachments, and, when the users opens them, these files prompt them to enable macro commands or the content will not be shown. When the users enables these macro commands, the commands stealthily downloads as well as install Azorult trojan. However, there is a catch, if the users open these malicious files via a program other than MS Office Tools, then, they won't open; in fact, Azorult only targets MS Windows, hence users of the other platforms are compl...

  To know more about it, you can go through my detailed document by clicking  here Overview Avenger is a downloader used by BRONZE BUTLER (since at least 2019) cyber espionage group active since 2008, and mainly targets Japanese organizations. Avenger can - drastically affect the Windows Operating System, send XOR encrypt files to C2, easily extract backdoor malware via downloaded images, inject shellcode, download C2 files to a compromised host, identify installed anti-viruses in the compromised host, etc... Capabilities This malware possesses following abilities: It can easily evade detection with the help of various techniques like- including encrypting or obfuscating files, using steganography, communicating through web traffic, etc.; which makes it very difficult to detect and analyze the malware. It can also use process injection, transfer tools, or the other files from an external system, and/or obfuscation techniques to hide the intrusive artifacts, in order to avoid a...

  To know more about it, you can go through my detailed document by clicking  here Overview AutoIt backdoor malware is extensively used by the threat actors responsible for MONSOON campaign via weaponized .pps files exploiting CVE-2014-6352. It generally uses the legitimate scripting language for Windows GUI automation with the same name.  How Does it Works? After its successful launch, the AutoIt script firstly installs its own version of file and generate its copy in the same directory, while also generating persistence via a shortcut added to the startup directory. The malware then easily installs its hidden copies on all the removable drives which are connected to the infected system, thus ensuring its spread to the other machines as well. This malware's techniques and tactics make it a significant threat to especially those companies who frequently uses removable media in the workplace and must practice regular security hygiene. Prevention The following methods will ...