Wednesday, December 6, 2023

Beware!! New “Nodersok” Fileless Malware Hack Windows PC and Change into Zombie Proxies

Microsoft issued a serious warning about the new form of stealthy fileless Malware campaign “Nodersok” that attacks windows computers using living-off-the-land techniques.

Living-off-the-land Binaries (LOLBin) technique refers to the abuse of legitimate windows tools and uses it to maintain its persistence and performing other malicious activities in the targeted windows machine.

Microsoft researchers are continuously following this campaign for several weeks and confirms that the malware has infected thousands of victims around the world and mainly targeting victims in the United States and Europe.

Threat actors employes the advanced fileless technique with this malware campaign that helps to easily penetrate the network and silently relies on the network infrastructure.

Researchers have initially uncovered this malware campaign in July through Microsoft defender telemetry data, and confirm that the Nodersok attack various sectors including Healthcare, Finance, Transport, Aerospace, Education and more.

Nodersok campaign mainly delivers 2 legitimate tools to infection the machine. one is Node.exe, a popular Node.js framework that is used in many apps and another one is WinDivert, a network capture utility.

These tools are neither malicious nor vulnerable but it provides some interesting features and Nodersok installs a pair of very peculiar tools using this fileless capability and changes the infected machines into zombie proxies.

Nodersok Malware Infection Chain

Attackers drop the HTA file through malicious ads and compromised websites into the victim’s machine, and the Javascript code that resides in the HTA file downloads the second stage component which is also another Javascript code.

Threat actors are particularly choosing the legitimate content delivery service Cloudfront which is not a malicious service but it helps the attacker to keep the detection alarm silent.

Researchers have learned that the same strategy was also used by the Astaroth campaign and the attacker abusing the legitimate storage.googleapis.com service. 

Once the malware has launched the second stage of component, it downloads the new PowerShell command by hiding the encoded command text inside of the environment variable.

Attack Chain (Click to enlarge) Credits: Microsoft

The Powershell command downloads and runs the additional encrypted components that will attempt to disable the Windows Defender antivirus program and windows updates.

Another binary Shellcode attempt to perform the elevation of system privileges and also download the legitimate node.exe tool from the official nodejs.org website.

According to Microsoft research, ” This last JavaScript is the actual final payload written for the Node.js framework that turns the device into a proxy. This concludes the infection, at the end of which the network packet filter is active and the machine is working as a potential proxy zombie.  “

Once the victim’s machine turns into a proxy, threat actors can gain access other network entities (websites, C&C servers, compromised machines, etc.), which can allow them to perform stealthy malicious activities. Microsoft said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

Serpent Stealer Acquires Browser Passwords and Erases Intrusion Logs

Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision...

Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

It has been observed that threat actors are using AI technology to conduct illicit...

Kali Linux 2023.4 Released – What’s New!

Kali Linux 2023.4, the latest version of Offensive Security's renowned operating system, has been...

Trickbot Malware Developer Pleads Guilty & Faces 35 Years in Prison

A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware....

ICANN Launches RDRS to Assist Law Enforcement Agencies to Discover Private Info

ICANN is a non-profit organization that is responsible for coordinating the global internet's-DNSIP address...

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles