A resilient infrastructure comprising over 250 domains used to distribute information-stealing malware such as Raccoon and Vidar since early 2020.
The infection chain uses about a hundred of fake cracked software catalogue websites which are redirect to several links before downloading the payload hosted on file share platforms such as GitHub.It led to distribution of information stealing software like raccoon and vidar
The French cybersecurity company access the domains which are operated by a threat actor running a traffic direction system (TDS) that allows other cybercriminals to rent the service to distribute their malware.
The attacks target users are searching for cracked versions of software and games on search engines like Google and surfacing fraudulent websites on top by leveraging a technique called search engine optimization which are poisoning to lure victims into downloading and executing the malicious payloads.
The poisoned result comes up with a download link to the promised software which upon clicking led to triggeration of a five-stage URL redirection sequence to take the user to a web page displaying a shortened link which points to a password-protected RAR archive file which hosted on GitHub along with its password.
Using several redirections led to complication of automated analysis by security solutions. Carving the infrastructure as such is almost certainly designed to ensure resilience and making it easier and quicker to update or change a step.
Victim uncompress the RAR archive and run the purported setup executable which is contained within it and either of the two malware families which include Raccoon or Vidar that are installed on the system.
The development that comes as Cyble detailed a rogue Google Ads campaign that employs widely-used software such as AnyDesk, Bluestacks, Notepad++, and Zoom as lures to deliver a feature-rich stealer known as Rhadamanthys Stealer.
An alternate variant of the attack chain is observed taking advantage of phishing emails masquerading as bank statements to dupe unwitting users into clicking on fraudulent links.
Fabricated websites impersonate the popular remote desktop solution have also been put to used in the past to propagate a Python-based information stealer dubbed Mitsu Stealer.
Both pieces of malware are equipped to siphon a wide range of personal information from compromised machines and harvest credentials from web browsers, and steal data from various cryptocurrency wallets.
Users are advised to avoid downloading pirated software and enforce multi-factor authentication wherever possible to harden accounts.
It is important for users to exercise caution when receiving spam emails or to visit phishing websites and to verify the source before downloading any applications.
