Monday, November 4, 2024
HomeMalwareHackers Abusing Window 10 Remote Desktop ActiveX control to Install New Version...

Hackers Abusing Window 10 Remote Desktop ActiveX control to Install New Version of Trickbot Malware

Published on

Malware protection

Researchers observed a new wave of infamous Trickbot Malware campaign via a dozen of malicious documents and infect the Windows users by abusing Remote Desktop ActiveX Control.

TrickBot is one of the top modular banking malware that primarily targets financial information of users’ and also it acts as a dropper for other malware.

Remote Desktop ActiveX Control recently introduced by Microsoft for Windows 10 that helps vendors to constantly update OS to protect the system.

- Advertisement - SIEM as a Service

But this feature is abusing in this attack was utilized to automatically execute the malicious Macro that contains the OSTAP javascript downloader

Researchers believe that other groups also misusing the same, and earlier controls although with a slightly different technique.

Malware Infection Process

Attackers using email is deliverable medium and distributing a spam email campaign with an attachment of malicious document following the naming convention “i<7-9 random digits>.doc“.

Also, they are using a social engineering technique to convenience victims to enable the content which leads to executing the malicious macro, Meanwhile, the image also hid an ActiveX control slightly below in the following image.

Remote Desktop ActiveX

Also the malicious OSTAP JavaScript downloader was hidden in the document with white color letters which was marked as red color in the above image.

According to morphisec research “Attackers also using an interesting method“<name>_OnDisconnected” to trigger function that is first executed. This method didn’t execute immediately as it takes time for it to try and resolve DNS to an empty string and then return an error”

Threat actors this attack also using the MsRdpClient10NotSafeForScripting class which is used for remote control which helps them to abuse to properly execute their own code.

Later  OSTAP is created in the form of a BAT file and once it executed, the word document form is closed. 

“There are hundreds of more objects that have been introduced in the latest Windows 10 and even dozens of more methods in the described object that sophisticated attackers can abuse. so updating your operating system is necessary for better security” Researchers said.

Also Read:

Urgent !! Windows User Urged to Patch A Critical Crypto Vulnerability on Windows 10, Clients & Servers Discovered By NSA

Microsoft Enables Tamper Protection by Default for all Windows 10 Users to Defend Against Attacks

Microsoft going for Passwordless login for Windows 10 – Bye! Bye! for Passwords

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy...

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Researchers discovered a Russian-linked threat actor, UNC5812, utilizing a Telegram persona named "Civil Defense....

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...