Infamous Iranian threat groups disguise the malware as the legitimate Cisco AnyConnect application to install Poison Frog backdoor by employing a various PowerShell Script.
Poison Frog is one of the most powerful Backdoor in the OilRig group arsenal, and it also contains a Panel with the parts of the server-side and the payload in PowerShell that used to various high profile cyber-attacks.
Researchers from Kaspersky observed a new sample which is a PE executable written in C#, and it has only functionality to drop the PowerShell script that contains a backdoor.
With the same logic, another PowerShell Script was found which has 2 different long string, and it contains DNS and HTTP backdoor (Poison Frog HTTP backdoor)
To install the malware, OilRig developers are using a clever trick and disguise the malware as the legitimate Cisco AnyConnect application.
According to Kaspersky’s report, Even though they made a small implementation mistake, info popup appears every time you click on it, which doesn’t happen with the benign application.
The above message help to fool users to trick them to think there is something wrong with the application or their internet access, but they backdoor silently installed on the system.
A newly identified phishing campaign is targeting unsuspecting users by masquerading as urgent Zoom meeting…
A newly identified piece of malware, dubbed the "Hannibal Stealer," has emerged as a significant…
Advanced persistent threat (APT) groups with ties to China have become persistent players in the…
Cache timing side-channel attacks have been used to circumvent Kernel Address Space Layout Randomization (KASLR)…
Cybersecurity researchers have unearthed a sophisticated attack leveraging AutoIT, a long-standing scripting language known for…
A disturbing 67% of businesses in eight worldwide markets—the US, UK, Spain, the Netherlands, Germany,…