Even the Windows logo isn’t safe from malware

It appears that not even the iconic Windows logo is safe from malware anymore, as some cybercriminals managed to successfully hide malicious code inside it.

Cybersecurity experts at Symantec claim to have spotted one such campaign using a process of hiding malicious code in otherwise harmless images, otherwise known as steganography.

It is usually done to avoid detection by antivirus programs, as such solutions rarely detect images as malicious.

Going after governments

In this particular case, the group engaged in steganography attacks is called Witchetty, a known threat-actor allegedly strongly tied to the Chinese state-sponsored actor Cicada (AKA APT10), and also considered part of the TA410 organization that has targeted US energy providers in the past.

The group kicked off its latest campaign in February 2022, targeting at least two governments in the Middle East.

What’s more, an attack against a stock exchange in Africa is allegedly still active. Witchetty used steganography attacks to hide an XOR-encrypted backdoor, which was hosted on a cloud service, minimizing its chances of detection. To drop webshells on vulnerable endpoints, the attackers exploited known Microsoft Exchange ProxyShell vulnerabilities for initial access: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-26855, and CVE-2021-27065.

“Disguising the payload in this fashion allowed the attackers to host it on a free, trusted service,” Symantec said. “Downloads from trusted hosts such as GitHub are far less likely to raise red flags than downloads from an attacker-controlled command-and-control (C&C) server.”

> Everyone’s favorite media player abused to launch malware attacks

> APT10 hacking group targets industrial businesses once again

> Here are the best ransomware protection tools right now

The XOR-encrypted backdoor allows threat actors to do a number of things, including tampering with files and folders, running and terminating processes, tweaking the Windows Registry, downloading additional malware, stealing documents, as well as turning the compromised endpoint into a C2 server.

Last time we heard of Cicada was in April 2022, when researchers reported the group had abused the popular VLC media player to distribute malware and spy on government agencies and adjacent organizations located in the US, Canada, Hong Kong, Turkey, Israel, India, Montenegro, and Italy.

Check out the best firewalls around

Via: BleepingComputer