Infamous Iranian threat groups disguise the malware as the legitimate Cisco AnyConnect application to install Poison Frog backdoor by employing a various PowerShell Script.
Poison Frog is one of the most powerful Backdoor in the OilRig group arsenal, and it also contains a Panel with the parts of the server-side and the payload in PowerShell that used to various high profile cyber-attacks.
Researchers from Kaspersky observed a new sample which is a PE executable written in C#, and it has only functionality to drop the PowerShell script that contains a backdoor.
With the same logic, another PowerShell Script was found which has 2 different long string, and it contains DNS and HTTP backdoor (Poison Frog HTTP backdoor)
To install the malware, OilRig developers are using a clever trick and disguise the malware as the legitimate Cisco AnyConnect application.
According to Kaspersky’s report, Even though they made a small implementation mistake, info popup appears every time you click on it, which doesn’t happen with the benign application.
The above message help to fool users to trick them to think there is something wrong with the application or their internet access, but they backdoor silently installed on the system.
MCP, developed by Anthropic, allows Large Language Models (LLMs) to interface seamlessly with external tools,…
Luxury department store Harrods has become the latest UK retailer to face a cyberattack, joining…
Nebulous Mantis, also known as Cuba, STORM-0978, Tropical Scorpius, and UNC2596, is a Russian-speaking cyber…
CISOs adopting DevSecOps strategically enhance security measures while ensuring fast-paced software development, responding to the…
Multiple Dutch organizations have experienced significant service disruptions this week due to a series of…
A major supply chain security incident has rocked the Python open-source community as researchers at…