Thursday, May 1, 2025
HomeCyber Security NewsHackers Abuse Windows Error Reporting (WER) Service in Fileless Malware Attack

Hackers Abuse Windows Error Reporting (WER) Service in Fileless Malware Attack

Published on

SIEM as a Service

Follow Us on Google News

Security researchers uncovered a new attack dubbed Kraken that uses injected its payload into the Windows Error Reporting service to evade detection.

The WerFault.exe is a service that shows some error happened with the operating system, Windows features, or applications, victims would assume some error happen, but attackers stealthy execute malware using the process.

Fileless Malware Attack

Security researchers from Malwarebytes observed a new attack with a zip file containing a malicious document dubbed “Compensation manual.doc” and it has an image tag that points to the website “yourrighttocompensation[.]com”.

- Advertisement - Google News

Inside the malicious document file, it includes a modified version of CactusTorch(shellcode launcher) VBA module that leverages the DotNetToJscript technique to load a .Net compiled binary into memory and execute it from VBScript.

Once it is opened by a victim it will execute the CactusTorch macro that loads the NET payload straight directly in the windows device’s memory.

The binary is executed on the window’s memory and injects embedded shellcode into the Windows process. As the binary executed on windows memory it won’t leave any traces on the hard disk.

The new maliciously created Windows Error Reporting service will before some anti-analysis checks such as not running in an analysis/sandbox environment or a debugger.

Once it feels safe after anti-analysis it decrypts and loads the final payload int he maliciously created Windows Error Reporting service. The payload is hosted on the website asia-kotoba[.]net in the name of favicon.

At the time of the report, the target URL was down, so that Malwarebytes unable to retrieve this shellcode for further analysis.

Researchers believe the attack relates to APT32, but not having enough evidence to attribute this attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

GitHub Launches Code Scanning Tool to Find Security Vulnerabilities – Available for All Users

Beware of the New Critical Zerologon Vulnerability in The Windows Server

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Netgear EX6200 Flaw Enables Remote Access and Data Theft

Security researchers have disclosed three critical vulnerabilities in the Netgear EX6200 Wi-Fi range extender...

Tesla Model 3 VCSEC Vulnerability Lets Hackers Run Arbitrary Code

A high security flaw in Tesla’s Model 3 vehicles, disclosed at the 2025 Pwn2Own...

Quantum Computing and Cybersecurity – What CISOs Need to Know Now

As quantum computing transitions from theoretical research to practical application, Chief Information Security Officers...

Apache ActiveMQ Vulnerability Lets Remote Hackers Execute Arbitrary Code

A high vulnerability in Apache ActiveMQ’s .NET Message Service (NMS) library has been uncovered,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Netgear EX6200 Flaw Enables Remote Access and Data Theft

Security researchers have disclosed three critical vulnerabilities in the Netgear EX6200 Wi-Fi range extender...

Tesla Model 3 VCSEC Vulnerability Lets Hackers Run Arbitrary Code

A high security flaw in Tesla’s Model 3 vehicles, disclosed at the 2025 Pwn2Own...

Apache ActiveMQ Vulnerability Lets Remote Hackers Execute Arbitrary Code

A high vulnerability in Apache ActiveMQ’s .NET Message Service (NMS) library has been uncovered,...