Tuesday, March 5, 2024

Cybercriminals Advertising Godzilla Loader Malware On Dark Web Forums

Cybercriminals Advertising Godzilla Loader Malware for $500 on Dark web forums, the malware found actively maintained and getting new updates periodically.

Godzilla modern downloader or dropper which first runs the binary on victim’s machine and then it downloads the payload form a remote server.

According to Checkpoint investigation, the Godzilla Loader malware rate of infection is very less when compared to its competitor, Emotet.

The Godzilla loader advertised as it comes with built-in UAC bypass, the User Account Control(UAC) is a Microsoft security tool that helps in preventing the intrusion of malicious software.

Godzilla Loader Malware

With the new version of “Godzilla, the author boasts that they have converted even more of the control flow to rely entirely on COM interfaces; persistence is achieved via the IPresistFile interface and shell executions of programs on the local disk are triggered via the IShellDispatch interface,” reads Checkpoint blog post.

It also performs other functions such as deletion of file backup, the only possible reason for it to be the anti-Ransomware measure which operates by recovering the original files from the shadow file backups.

The threat actors offered a bouble-layered fail-safe for C&C communication and employs RSA-2048 to verify the identity of the C&C server.

Last version of the malware appears to be under development from last December, the latest version contains propagation module, keylogger module and password stealing module.

Based on it’s existence and adoption rate, researchers said it could be a good example for the principle of the Long Tail.

Related Read:

Dark Web Market Silk Road Admin Pleads Guilty, Prison Up to 20 Years

Hackers Selling Facebook Account Logins Details On Dark Web For $3

Dark Web Malware Builder Allow Attackers To Create Malware That Steals Passwords & Credit Card Data

Website

Latest articles

US Court Orders NSO Group to Handover Code for Spyware, Pegasus to WhatsApp

Meta, the company that owns WhatsApp, filed a lawsuit against NSO Group in 2019....

New SSO-Based Phishing Attack Trick Users into Sharing Login Credentials  

Threat actors employ phishing scams to trick individuals into giving away important details like...

U.S. Charged Iranian Hacker, Rewards up to $10 Million

The United States Department of Justice (DoJ) has charged an Iranian national, Alireza Shafie...

Huge Surge in Ransomware-as-a-Service Attacks targeting Middle East & Africa

The Middle East and Africa (MEA) region has witnessed a surge in ransomware-as-a-service (RaaS)...

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles