Valak Malware Attacks Microsoft Exchange Servers to Steal Enterprise Passwords

Valak Malware malware first observed in the year 2019, the malware is not only a loader it can be used as an information stealer to target individuals and enterprises.

Researchers observed a new Valak malware campaign that particularly targets the US and Germany. In the new campaign, it was developed as a sophisticated, multi-stage modular from the loader.

Valak Malware Campaign

According to Cybereason researchers, the new campaign the common infection vector is the Microsoft Word documents embedded with malicious macro code.

The document found to be created in both English and German language and distributed depending on the geolocation of the target.

The weaponized word document contains malicious macro code that downloads other stages of the payload. The initial stage of the malware is a fileless stage that stores various components in the registry.

In the reconnaissance phase, it collects the following data from the infected hosts such as; user, machine, and network information from infected hosts, also it checks for geolocation of the victim’s machine.

The malware also takes screenshots of the infected machine and also download plugins and other malware like Ursnif or IcedID to handle other operations.

The new version of the malware attacker expands it with several plugin components for reconnaissance and information stealing.

Threats updated the Valak as most stealthy malware that uses advanced techniques like ADS and hiding components in the registry.

The malware mainly targets administrators and enterprises network, it collects and steals sensitive information from the Microsoft Exchange mail system, including credentials and the domain certificate

Researchers observed that malware is using shared infrastructure among almost all of its different versions.

“Given the fact that both Ursnif and IcedID are considered to be part of the Russian-speaking E-Crime ecosystem, it is possible that the authors of Valak are also part of that Russian-speaking underground community.”

The Valak malware with it’s extended capabilities suggest that it can be used independently with or without teaming up with other malware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

3 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago