Categories: Malware

OilRig Iranian Threat Group Install “Poison Frog” Backdoor on Windows By Disguise Legitimate Cisco Tool

Infamous Iranian threat groups disguise the malware as the legitimate Cisco AnyConnect application to install Poison Frog backdoor by employing a various PowerShell Script.

Poison Frog is one of the most powerful Backdoor in the OilRig group arsenal, and it also contains a Panel with the parts of the server-side and the payload in PowerShell that used to various high profile cyber-attacks.

Researchers from Kaspersky observed a new sample which is a PE executable written in C#, and it has only functionality to drop the PowerShell script that contains a backdoor.

With the same logic, another PowerShell Script was found which has 2 different long string, and it contains DNS and HTTP backdoor (Poison Frog HTTP backdoor)

Poison Frog Installation Process

To install the malware, OilRig developers are using a clever trick and disguise the malware as the legitimate Cisco AnyConnect application.

According to Kaspersky’s report, Even though they made a small implementation mistake, info popup appears every time you click on it, which doesn’t happen with the benign application.

The above message help to fool users to trick them to think there is something wrong with the application or their internet access, but they backdoor silently installed on the system.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

New MCP-Based Attack Techniques and Their Application in Building Advanced Security Tools

MCP, developed by Anthropic, allows Large Language Models (LLMs) to interface seamlessly with external tools,…

6 minutes ago

Cyberattack Targets Iconic UK Retailer Harrods

Luxury department store Harrods has become the latest UK retailer to face a cyberattack, joining…

36 minutes ago

Nebulous Mantis hackers have Deployed the RomCom RAT globally, Targeting organizations.

Nebulous Mantis, also known as Cuba, STORM-0978, Tropical Scorpius, and UNC2596, is a Russian-speaking cyber…

50 minutes ago

Why CISOs Are Adopting DevSecOps for Secure Software Development

CISOs adopting DevSecOps strategically enhance security measures while ensuring fast-paced software development, responding to the…

52 minutes ago

Dutch Services Disrupted by DDoS Attacks From Russian-Affiliated Hacktivists

Multiple Dutch organizations have experienced significant service disruptions this week due to a series of…

11 hours ago

Seven Malicious Packages Exploit Gmail SMTP to Run Harmful Commands

A major supply chain security incident has rocked the Python open-source community as researchers at…

11 hours ago