The cybersecurity analysts at Check Point Research recently reported that TrickGate, a shellcode-based packer, has been in operation for over six years without being detected. It has enabled threat actors to deploy various types of malware such as:-
TrickGate is a transformative packer that has managed to evade detection for several years. This is because it periodically undergoes changes, which allows it to remain hidden from security measures.
Since late 2016 TrickGate has been available as a service to other threat actors, behind a layer of wrapper code it’s furnishing a means of disguising payloads.
This is done in an effort to bypass security solutions installed on the target host, making it easier for malicious actors to execute their attacks undetected.
Packers can serve a dual purpose as cryptos by encrypting malware in order to obfuscate it. This mechanism makes it more difficult for security solutions to detect and analyze the malicious code, allowing the attacker to operate with a lower risk of being discovered.
Packers are designed to evade detection by security solutions, and they do this through a variety of features. Some packers can appear as benign files, making it difficult for security tools to identify them as malicious.
Others are designed to be difficult to reverse engineer, making it harder for analysts to understand the behavior of the malware they are designed to hide.
Additionally, some packers incorporate sandbox evasion techniques, allowing them to avoid detection by security systems that use sandboxes to execute and analyze code.
Over the last two years, security experts have reported monitoring between 40 to 650 attacks per week. However, the frequent updates to TrickGate as a commercial packer-as-a-service have resulted in it being tracked under different names since 2019 and here below we have mentioned those names:-
While the complete attack flow involves the following things:-
Check Point’s telemetry data suggests that the threat actors utilizing TrickGate have primarily targeted the manufacturing sector, with education, healthcare, government, and finance also being impacted to a lesser extent.
In the past two months, the most commonly observed malware families used in attacks include:-
While the significant concentrations of these malware families are in the following countries:-
The process of spreading an infection involves the use of phishing emails that contain harmful attachments or links. These links, when clicked, result in the download of a shellcode loader. The role of this loader is to decrypt and activate the actual payload, causing it to be launched into the memory.
Network Security Checklist – Download Free E-Book
A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…
Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…
An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…
A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…
The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…
NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…