Tuesday, January 28, 2025
HomeCyber Security NewsHackers Use TrickGate Packer to Deploy Emotet, Cobalt Strike & Other Malware

Hackers Use TrickGate Packer to Deploy Emotet, Cobalt Strike & Other Malware

Published on

SIEM as a Service

Follow Us on Google News

The cybersecurity analysts at Check Point Research recently reported that TrickGate, a shellcode-based packer, has been in operation for over six years without being detected. It has enabled threat actors to deploy various types of malware such as:- 

  • TrickBot
  • Emotet
  • Cobalt Strike
  • AZORult
  • Agent Tesla
  • FormBook
  • Cerber
  • Maze
  • REvil

TrickGate is a transformative packer that has managed to evade detection for several years. This is because it periodically undergoes changes, which allows it to remain hidden from security measures.

Since late 2016 TrickGate has been available as a service to other threat actors, behind a layer of wrapper code it’s furnishing a means of disguising payloads. 

This is done in an effort to bypass security solutions installed on the target host, making it easier for malicious actors to execute their attacks undetected.

Packers can serve a dual purpose as cryptos by encrypting malware in order to obfuscate it. This mechanism makes it more difficult for security solutions to detect and analyze the malicious code, allowing the attacker to operate with a lower risk of being discovered.

Packers are designed to evade detection by security solutions, and they do this through a variety of features. Some packers can appear as benign files, making it difficult for security tools to identify them as malicious. 

Others are designed to be difficult to reverse engineer, making it harder for analysts to understand the behavior of the malware they are designed to hide. 

Additionally, some packers incorporate sandbox evasion techniques, allowing them to avoid detection by security systems that use sandboxes to execute and analyze code. 

TrickGate Packer Used to Deploy Malware

Over the last two years, security experts have reported monitoring between 40 to 650 attacks per week. However, the frequent updates to TrickGate as a commercial packer-as-a-service have resulted in it being tracked under different names since 2019 and here below we have mentioned those names:-

  • New loader
  • Loncom
  • NSIS-based crypter

While the complete attack flow involves the following things:-

  • Initial Access
  • Initial Files
  • Shellcode Loader
  • Shellcode
  • Payload

Check Point’s telemetry data suggests that the threat actors utilizing TrickGate have primarily targeted the manufacturing sector, with education, healthcare, government, and finance also being impacted to a lesser extent.

In the past two months, the most commonly observed malware families used in attacks include:-

  • FormBook
  • LokiBot
  • Agent Tesla
  • Remcos
  • Nanocore

While the significant concentrations of these malware families are in the following countries:-

  • Taiwan
  • Turkey
  • Germany
  • Russia
  • China

The process of spreading an infection involves the use of phishing emails that contain harmful attachments or links. These links, when clicked, result in the download of a shellcode loader. The role of this loader is to decrypt and activate the actual payload, causing it to be launched into the memory.

Network Security Checklist – Download Free E-Book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

White House Considers Oracle-Led Takeover of TikTok with U.S. Investors

In a significant development, the Trump administration is reportedly formulating a plan to prevent...

Critical Vulnerability in IBM Security Directory Enables Session Cookie Theft

IBM has announced the resolution of several security vulnerabilities affecting its IBM Security Directory...

Critical Apache Solr Vulnerability Grants Write Access to Attackers on Windows

A new security vulnerability has been uncovered in Apache Solr, affecting versions 6.6 through...

GitHub Vulnerability Exposes User Credentials via Malicious Repositories

A cybersecurity researcher recently disclosed several critical vulnerabilities affecting Git-related projects, revealing how improper...

API Security Webinar

Free Webinar - DevSecOps Hacks

By embedding security into your CI/CD workflows, you can shift left, streamline your DevSecOps processes, and release secure applications faster—all while saving time and resources.

In this webinar, join Phani Deepak Akella ( VP of Marketing ) and Karthik Krishnamoorthy (CTO), Indusface as they explores best practices for integrating application security into your CI/CD workflows using tools like Jenkins and Jira.

Discussion points

Automate security scans as part of the CI/CD pipeline.
Get real-time, actionable insights into vulnerabilities.
Prioritize and track fixes directly in Jira, enhancing collaboration.
Reduce risks and costs by addressing vulnerabilities pre-production.

More like this

White House Considers Oracle-Led Takeover of TikTok with U.S. Investors

In a significant development, the Trump administration is reportedly formulating a plan to prevent...

Critical Vulnerability in IBM Security Directory Enables Session Cookie Theft

IBM has announced the resolution of several security vulnerabilities affecting its IBM Security Directory...

Critical Apache Solr Vulnerability Grants Write Access to Attackers on Windows

A new security vulnerability has been uncovered in Apache Solr, affecting versions 6.6 through...