Friday, December 1, 2023

Valak Malware Attacks Microsoft Exchange Servers to Steal Enterprise Passwords

Valak Malware malware first observed in the year 2019, the malware is not only a loader it can be used as an information stealer to target individuals and enterprises.

Researchers observed a new Valak malware campaign that particularly targets the US and Germany. In the new campaign, it was developed as a sophisticated, multi-stage modular from the loader.

Valak Malware Campaign

According to Cybereason researchers, the new campaign the common infection vector is the Microsoft Word documents embedded with malicious macro code.

The document found to be created in both English and German language and distributed depending on the geolocation of the target.

Valak Malware

The weaponized word document contains malicious macro code that downloads other stages of the payload. The initial stage of the malware is a fileless stage that stores various components in the registry.

In the reconnaissance phase, it collects the following data from the infected hosts such as; user, machine, and network information from infected hosts, also it checks for geolocation of the victim’s machine.

The malware also takes screenshots of the infected machine and also download plugins and other malware like Ursnif or IcedID to handle other operations.

The new version of the malware attacker expands it with several plugin components for reconnaissance and information stealing.

Threats updated the Valak as most stealthy malware that uses advanced techniques like ADS and hiding components in the registry.

The malware mainly targets administrators and enterprises network, it collects and steals sensitive information from the Microsoft Exchange mail system, including credentials and the domain certificate

Researchers observed that malware is using shared infrastructure among almost all of its different versions.

Valak Malware

“Given the fact that both Ursnif and IcedID are considered to be part of the Russian-speaking E-Crime ecosystem, it is possible that the authors of Valak are also part of that Russian-speaking underground community.”

The Valak malware with it’s extended capabilities suggest that it can be used independently with or without teaming up with other malware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

Zyxel Command Injection Flaws Let Attackers Run OS Commands

Three Command injection vulnerabilities have been discovered in Zyxel NAS (Network Attached Storage) products,...

North Korean Hackers Attacking macOS Using Weaponized Documents

Hackers often use weaponized documents to exploit vulnerabilities in software, which enables the execution...

Most Popular Websites Still Allow Users To Have Weak Passwords

The latest analysis shows that tens of millions of people are creating weak passwords...

Chrome Zero-Day Vulnerability That Exploited In The Wild

Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles