Sunday, May 18, 2025
HomeMalwarePowerful APT Malware "Slingshot" Performs Highly Sophisticated Cyber Attack to Compromise Router

Powerful APT Malware “Slingshot” Performs Highly Sophisticated Cyber Attack to Compromise Router

Published on

SIEM as a Service

Follow Us on Google News

Cyber criminals performing a highly sophisticated attack using APT Malware called Slingshot to compromise routers and gain the administrator level access.

Slingshot is one of the powerful cyber threat actor that mainly targeting individuals and organization and the major victims belong to Africa and the Middle East.

Researchers identified a malicious library function injection technique in the virtual file system that is an indication of APT interaction in the network.

- Advertisement - Google News

Attackers compromised the Mikrotik routers using this Slingshot APT that will provide a complete router access.

Slingshot  attacked 100 of victims who is located in Kenya, Yemen, Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania.

In mainly infected the many of individuals rather than an organisation but some of the  attack indication referrers to few of government institution in  Kenya and the Yemen.

Also Read:  Beware of FlawedAmmyy RAT that Steals Credentials and Record Audio Chat

How Slingshot APT Attack Works

Slingshot APT attack very powerful creation by its authors and it developed with very sophisticated techniques to compromise the victims  through a Windows exploit or compromised Mikrotik routers.

Initially victims runs the Winbox Loader software that downloads some DLLs by connecting to the router from routers file system which is already compromised and it contains malicious embedded code.

One of the DLL called “ipv4.dll” which is used to download other malicious components and run it into the users system.

According to kaspersky researchers, To run its code in kernel mode in the most recent versions of operating systems, that have Driver Signature Enforcement, Slingshot loads signed vulnerable drivers and runs its own code through their vulnerabilities. .

later Slingshot will load a malicious modules in both kernel mode(Cahnadr) and user mode(GollumApp) and these module will play a major role to performing an information gathering operation and exfiltrate the sensitive data.

Slingshot Also evade the security system and avoid detection by encrypting all strings and using a number of Anti-bug techniques.

After the complete infection, slingshot will collect the sensitive information such as screenshots, keyboard data, USB connections.

Since it have a kernel level access, slingsgot will collect all the relevant information it need such as credit card numbers, password hashes, social security account numbers etc.

Researchers haven’t seen Slingshot exploit any zero-days, but that doesn’t mean that it doesn’t – that part of a story is still unclear for us.  But it does exploit known vulnerabilities in drivers to pass executable code into kernel mode. Kaspersky said.Router

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...

New Ransomware Attack Targets Elon Musk Supporters Using PowerShell to Deploy Payloads

A newly identified ransomware campaign has emerged, seemingly targeting supporters of Elon Musk through...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Printer Company Distributes Malicious Drivers Infected with XRed Malware

Procolored, a printer manufacturing company, has been found distributing software drivers infected with malicious...

Frigidstealer Malware Targets macOS Users to Harvest Login Credentials

An macOS users, a new information-stealing malware dubbed FrigidStealer has emerged as a formidable...

SSH Auth Key Reuse Uncovers Advanced Targeted Phishing Campaign

A meticulously orchestrated phishing campaign targeting Kuwait's fisheries, telecommunications, and insurance sectors has been...