Tuesday, January 14, 2025
HomeComputer SecurityBeware!! New "Nodersok" Fileless Malware Hack Windows PC and Change into Zombie...

Beware!! New “Nodersok” Fileless Malware Hack Windows PC and Change into Zombie Proxies

Published on

Microsoft issued a serious warning about the new form of stealthy fileless Malware campaign “Nodersok” that attacks windows computers using living-off-the-land techniques.

Living-off-the-land Binaries (LOLBin) technique refers to the abuse of legitimate windows tools and uses it to maintain its persistence and performing other malicious activities in the targeted windows machine.

Microsoft researchers are continuously following this campaign for several weeks and confirms that the malware has infected thousands of victims around the world and mainly targeting victims in the United States and Europe.

Threat actors employes the advanced fileless technique with this malware campaign that helps to easily penetrate the network and silently relies on the network infrastructure.

Researchers have initially uncovered this malware campaign in July through Microsoft defender telemetry data, and confirm that the Nodersok attack various sectors including Healthcare, Finance, Transport, Aerospace, Education and more.

Nodersok campaign mainly delivers 2 legitimate tools to infection the machine. one is Node.exe, a popular Node.js framework that is used in many apps and another one is WinDivert, a network capture utility.

These tools are neither malicious nor vulnerable but it provides some interesting features and Nodersok installs a pair of very peculiar tools using this fileless capability and changes the infected machines into zombie proxies.

Nodersok Malware Infection Chain

Attackers drop the HTA file through malicious ads and compromised websites into the victim’s machine, and the Javascript code that resides in the HTA file downloads the second stage component which is also another Javascript code.

Threat actors are particularly choosing the legitimate content delivery service Cloudfront which is not a malicious service but it helps the attacker to keep the detection alarm silent.

Researchers have learned that the same strategy was also used by the Astaroth campaign and the attacker abusing the legitimate storage.googleapis.com service. 

Once the malware has launched the second stage of component, it downloads the new PowerShell command by hiding the encoded command text inside of the environment variable.

Attack Chain (Click to enlarge) Credits: Microsoft

The Powershell command downloads and runs the additional encrypted components that will attempt to disable the Windows Defender antivirus program and windows updates.

Another binary Shellcode attempt to perform the elevation of system privileges and also download the legitimate node.exe tool from the official nodejs.org website.

According to Microsoft research, ” This last JavaScript is the actual final payload written for the Node.js framework that turns the device into a proxy. This concludes the infection, at the end of which the network packet filter is active and the machine is working as a potential proxy zombie.  “

Once the victim’s machine turns into a proxy, threat actors can gain access other network entities (websites, C&C servers, compromised machines, etc.), which can allow them to perform stealthy malicious activities. Microsoft said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Critical macOS Vulnerability Lets Hackers to Bypass Apple’s System Integrity Protection

Microsoft Threat Intelligence has uncovered a critical macOS vulnerability that allowed attackers to bypass...

CISA Released A Free Guide to Enhance OT Product Security

To address rising cyber threats targeting critical infrastructure, the U.S. Cybersecurity and Infrastructure Security...

Microsoft Warns of MFA Issue Affecting Microsoft 365 users

Microsoft has issued a warning regarding an ongoing issue with Multi-Factor Authentication (MFA) that...

RedCurl APT Deploys Malware via Windows Scheduled Tasks Exploitation

Researchers identified RedCurl APT group activity in Canada in late 2024, where the attackers...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Critical macOS Vulnerability Lets Hackers to Bypass Apple’s System Integrity Protection

Microsoft Threat Intelligence has uncovered a critical macOS vulnerability that allowed attackers to bypass...

CISA Released A Free Guide to Enhance OT Product Security

To address rising cyber threats targeting critical infrastructure, the U.S. Cybersecurity and Infrastructure Security...

Microsoft Warns of MFA Issue Affecting Microsoft 365 users

Microsoft has issued a warning regarding an ongoing issue with Multi-Factor Authentication (MFA) that...