Wednesday, April 17, 2024

Hackers Use TrickGate Packer to Deploy Emotet, Cobalt Strike & Other Malware

The cybersecurity analysts at Check Point Research recently reported that TrickGate, a shellcode-based packer, has been in operation for over six years without being detected. It has enabled threat actors to deploy various types of malware such as:- 

  • TrickBot
  • Emotet
  • Cobalt Strike
  • AZORult
  • Agent Tesla
  • FormBook
  • Cerber
  • Maze
  • REvil

TrickGate is a transformative packer that has managed to evade detection for several years. This is because it periodically undergoes changes, which allows it to remain hidden from security measures.

Since late 2016 TrickGate has been available as a service to other threat actors, behind a layer of wrapper code it’s furnishing a means of disguising payloads. 

This is done in an effort to bypass security solutions installed on the target host, making it easier for malicious actors to execute their attacks undetected.

Packers can serve a dual purpose as cryptos by encrypting malware in order to obfuscate it. This mechanism makes it more difficult for security solutions to detect and analyze the malicious code, allowing the attacker to operate with a lower risk of being discovered.

Packers are designed to evade detection by security solutions, and they do this through a variety of features. Some packers can appear as benign files, making it difficult for security tools to identify them as malicious. 

Others are designed to be difficult to reverse engineer, making it harder for analysts to understand the behavior of the malware they are designed to hide. 

Additionally, some packers incorporate sandbox evasion techniques, allowing them to avoid detection by security systems that use sandboxes to execute and analyze code. 

TrickGate Packer Used to Deploy Malware

Over the last two years, security experts have reported monitoring between 40 to 650 attacks per week. However, the frequent updates to TrickGate as a commercial packer-as-a-service have resulted in it being tracked under different names since 2019 and here below we have mentioned those names:-

  • New loader
  • Loncom
  • NSIS-based crypter

While the complete attack flow involves the following things:-

  • Initial Access
  • Initial Files
  • Shellcode Loader
  • Shellcode
  • Payload

Check Point’s telemetry data suggests that the threat actors utilizing TrickGate have primarily targeted the manufacturing sector, with education, healthcare, government, and finance also being impacted to a lesser extent.

In the past two months, the most commonly observed malware families used in attacks include:-

  • FormBook
  • LokiBot
  • Agent Tesla
  • Remcos
  • Nanocore

While the significant concentrations of these malware families are in the following countries:-

  • Taiwan
  • Turkey
  • Germany
  • Russia
  • China

The process of spreading an infection involves the use of phishing emails that contain harmful attachments or links. These links, when clicked, result in the download of a shellcode loader. The role of this loader is to decrypt and activate the actual payload, causing it to be launched into the memory.

Network Security Checklist – Download Free E-Book


Latest articles

Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

In today's digital landscape, email security has become a critical concern for businesses of...

Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

In a digital age where information is the new currency, the recent global hack...

Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges

Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange's smart contract by injecting fabricated...

Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information

Omni Hotels & Resorts has revealed that it was the target of a recent...

Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS

A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.Dubbed...

TA558 Hackers Compromised 320+ Organizations’ FTP & SMTP Servers

TA558, a financially motivated threat actor identified in 2018, is targeting several countries but...

Blackjack Hackers Destroyed 87,000 Sensors Using Lethal ICS Malware

A group of cybercriminals known as "Blackjack" has launched a devastating attack on industrial...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles