Categories: Malware

OilRig Iranian Threat Group Install “Poison Frog” Backdoor on Windows By Disguise Legitimate Cisco Tool

Infamous Iranian threat groups disguise the malware as the legitimate Cisco AnyConnect application to install Poison Frog backdoor by employing a various PowerShell Script.

Poison Frog is one of the most powerful Backdoor in the OilRig group arsenal, and it also contains a Panel with the parts of the server-side and the payload in PowerShell that used to various high profile cyber-attacks.

Researchers from Kaspersky observed a new sample which is a PE executable written in C#, and it has only functionality to drop the PowerShell script that contains a backdoor.

With the same logic, another PowerShell Script was found which has 2 different long string, and it contains DNS and HTTP backdoor (Poison Frog HTTP backdoor)

Poison Frog Installation Process

To install the malware, OilRig developers are using a clever trick and disguise the malware as the legitimate Cisco AnyConnect application.

According to Kaspersky’s report, Even though they made a small implementation mistake, info popup appears every time you click on it, which doesn’t happen with the benign application.

The above message help to fool users to trick them to think there is something wrong with the application or their internet access, but they backdoor silently installed on the system.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

New Phishing Attack Poses as Zoom Meeting Invites to Steal Login Credentials

A newly identified phishing campaign is targeting unsuspecting users by masquerading as urgent Zoom meeting…

4 hours ago

New Hannibal Stealer Uses Stealth and Obfuscation to Evade Detection

A newly identified piece of malware, dubbed the "Hannibal Stealer," has emerged as a significant…

4 hours ago

Chinese APT Hackers Target Organizations Using Korplug Loaders and Malicious USB Drives

Advanced persistent threat (APT) groups with ties to China have become persistent players in the…

4 hours ago

Cache Timing Techniques Used to Bypass Windows 11 KASLR and Reveal Kernel Base

Cache timing side-channel attacks have been used to circumvent Kernel Address Space Layout Randomization (KASLR)…

5 hours ago

Hackers Exploit AutoIT Scripts to Deploy Malware Targeting Windows Systems

Cybersecurity researchers have unearthed a sophisticated attack leveraging AutoIT, a long-standing scripting language known for…

6 hours ago

New Report Finds 67% of Organizations Experienced Cyber Attacks in the Last Year

A disturbing 67% of businesses in eight worldwide markets—the US, UK, Spain, the Netherlands, Germany,…

7 hours ago