Wednesday, April 24, 2024

OilRig Iranian Threat Group Install “Poison Frog” Backdoor on Windows By Disguise Legitimate Cisco Tool

Infamous Iranian threat groups disguise the malware as the legitimate Cisco AnyConnect application to install Poison Frog backdoor by employing a various PowerShell Script.

Poison Frog is one of the most powerful Backdoor in the OilRig group arsenal, and it also contains a Panel with the parts of the server-side and the payload in PowerShell that used to various high profile cyber-attacks.

Researchers from Kaspersky observed a new sample which is a PE executable written in C#, and it has only functionality to drop the PowerShell script that contains a backdoor.

With the same logic, another PowerShell Script was found which has 2 different long string, and it contains DNS and HTTP backdoor (Poison Frog HTTP backdoor)

Poison Frog Installation Process

To install the malware, OilRig developers are using a clever trick and disguise the malware as the legitimate Cisco AnyConnect application.

According to Kaspersky’s report, Even though they made a small implementation mistake, info popup appears every time you click on it, which doesn’t happen with the benign application.

The above message help to fool users to trick them to think there is something wrong with the application or their internet access, but they backdoor silently installed on the system.

Website

Latest articles

Spyroid RAT Attacking Android Users to Steal Confidential Data

A new type of Remote Access Trojan (RAT) named Spyroid has been identified.This...

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...

Rewards Up to $10 Million for Information on Iranian Hackers

The United States Justice Department has announced big rewards for information leading to the...

PoC Exploit Released For Critical Oracle VirtualBox Vulnerability

Oracle Virtualbox was identified and reported as having a critical vulnerability associated with Privilege...

Tracing the Steps of Cyber Intruders: The Path of Lateral Movement

When cyber attacks strike, it's rarely a single computer that suffers. Nowadays, cybercriminals set...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

WAAP/WAF ROI Analysis

Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles