Stenography alert: Backdoor spyware stashed in Microsoft logo

microsoft, stenography alert: backdoor spyware stashed in microsoft logo

Stenography alert: Backdoor spyware stashed in Microsoft logo

Now that’s sticker shock

Internet snoops has been caught concealing spyware in an old Windows logo in an attack on governments in the Middle East.…

The Witchetty gang used steganography to stash backdoor Windows malware, dubbed Backdoor.Stegmap, in the bitmap image.

“Although rarely used by attackers, if successfully executed, steganography can be leveraged to disguise malicious code in seemingly innocuous-looking image files,” researchers at Symantec’s Threat Hunter Team wrote this week. “Disguising the payload in this fashion allowed the attackers to host it on a free, trusted service.”

From what we can tell, Witchetty first compromises a network, getting into one or more systems, then downloads this image from, say, a repository on GitHub, unpacks the spyware within it, and runs it.

Hiding the payload in this way, and placing the file somewhere innocuous online, is a big advantage in evading security software, as “downloads from trusted hosts such as GitHub are far less likely to raise red flags than downloads from an attacker-controlled command-and-control (C&C) server,” the team said.

Thus, fetching this pic after gaining initial access is less likely to set off internal alarms.

In April analysts at European cybersecurity shop ESET documented Witchetty – which they called LookingFrog at the time – as one of three subgroups within TA410, an espionage group with loose ties to the APT10 (aka Cicada) gang known for targeting enterprises in the US utility sector and diplomatic organizations in the Middle East and Africa.

APT10, also known as Red Apollo and Stone Panda, earlier this year ran a campaign against financial services firms in Taiwan. LookingFrog, FlowingFrog, and JollyFrog are the three subgroups of TA410, with LookingFrog focusing its efforts on the Middle East and a small part of Africa, according to ESET.

The use of Stegmap is part of a larger update of Witchetty’s toolset, the Symantec researchers wrote. The group has been known to use a first-stage backdoor known as X4 and a second-stage payload called LookBack, which ESET said targets governments, diplomatic missions, charities, and industrial and manufacturing organizations.

Witchetty continues to use LookBack, but has added Stegmap and other malware to its arsenal. To bring Stegmap into a network, a DLL loader is run that downloads the bitmap file of the Windows logo from a GitHub repository. The payload is hiding in the bitmap file and is decrypted with an XOR operation and key.

The payload opens a backdoor to the outside world and can execute a range of commands issued to it by its masters, from copying, moving, or deleting files to removing a directory, starting a new process, or killing an existing one, and creating or deleting a Windows registry key.

The Symantec researchers wrote that Witchetty launched an espionage campaign against two Middle Eastern governments and a stock exchange in Africa using Stegmap. Initial access into a target’s network is gained by exploiting the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange and installed malicious scripts on public-facing web servers. From that point, the attackers were able to steal login credentials from users, move laterally through the corporate network, and install Stegmap and other software nasties on computers.

Witchetty also makes use of Mimikatz, a port scanner, and other tools. This includes one that adds itself to autostart in the registry, being listed as “Nvidia display core component,” to ensure the malicious code is run again on a reboot.

“Witchetty has demonstrated the ability to continually refine and refresh its toolset in order to compromise targets of interest,” the researchers wrote.

“Exploitation of vulnerabilities on public-facing servers provides it with a route into organizations, while custom tools paired with adept use of living-off-the-land tactics allow it to maintain a long-term, persistent presence in targeted organizations.” ®

News Related


Severe Weather Delays Over 2,500 Post-Thanksgiving Flights in US

At least 63 flights had been canceled and 2,564 more had been delayed shortly before noon, according to Read more »

Severe weather 'outbreak' to impact South, threatening 25M from Texas to Illinois

A massive storm system moving into the Pacific Northwest on Sunday is predicted to bring severe weather ranging from strong winds and rain to a few tornadoes in the South, meteorologists ... Read more »

4 fun ways to use natural garlands this Holiday season

HOUSTON – It’s time to say yes to fresh garlands! Kim Czuppon and Jessica Malpass, co-owners of Forget-Me-Not Pots, showed us different styles for home décor and simple ways to ... Read more »

'Dangerous precedent': Why constitutional experts are up in arms over move supported by Government

A group of leading constitutional experts have written an open letter urging the Government to rethink its support for an amendment to the Three Waters legislation. The amendment would add ... Read more »

Video: Amari Cooper Had Worst Drop Of The NFL Season Today

CLEVELAND, OHIO – SEPTEMBER 22: Amari Cooper #2 of the Cleveland Browns makes a catch during the fourth quarter against the Pittsburgh Steelers at FirstEnergy Stadium on September 22, 2022 ... Read more »

10 Most Reliable Compact SUVs Of 2022

10 Most Reliable Compact SUVs Of 2022 Compact SUVs are the most popular vehicles in the world, as they are both cost-effective and practical, with plenty of luggage capacity and ... Read more »

Shake ‘n Bake makes major change to its iconic ‘shakeable’ packaging: ‘It’s an adjustment [we’re] happy to make’

Shake ‘n Bake delicious dinner In a step to reduce plastic waste, Shake ‘N Bake is shaking up its packaging with the removal of the iconic “shaker” bag. The packaging ... Read more »

Widow of man killed in Southcenter parking garage seeks accountability

Widow of man killed in Southcenter parking garage seeks accountability Mary Wesolowicz said she and her husband Chris had gone to Westfield Southcenter mall for dinner many times. But as ... Read more »

Former Royal Butler Reveals What Amazed Him About King Charles’ Infamous Pen Incident

Just a few days into his reign as Britain’s new monarch, King Charles III was making headlines for a reason he probably wished he hadn’t when he was seen on ... Read more »

Friendly Fire: Rams coach Sean McVay takes a shot to jaw from his own player

Friendly Fire: Rams coach Sean McVay takes a shot to jaw from his own player Seattle’s division rival, the Los Angeles Rams are in Kansas City to take on the ... Read more »

Penn State breaks top 10 in AP poll

Penn State breaks top 10 in AP poll The Associated Press released their Top 25 college football teams Sunday, with Penn State moving up in the rankings. This week, they ... Read more »

RUMOR: Barcelona legend Sergio Busquets joining Inter Miami amid Lionel Messi links

11-27-22 David Beckham and Inter Miami are in hot pursuit of PSG and Argentina superstar Lionel Messi, hoping to lure him to the MLS in June of 2023. The club ... Read more »

Sean McVay takes nasty hit to the head after being blindsided by Rams player running onto field

KANSAS CITY, MISSOURI – NOVEMBER 27: Head coach Sean McVay of the Los Angeles Rams reacts before a game against the Kansas City Chiefs at Arrowhead Stadium on November 27, ... Read more »

Police Seek Hit-and-Run Driver Who Struck Elderly Pedestrian in South Chicago

Chicago police are looking to find the driver who struck an elderly person and then sped away Saturday in the South Chicago neighborhood, authorities said. The crash was reported at ... Read more »

Phone numbers of half a billion WhatsApp users leaked online in one of the largest data breaches

India, Nov. 27 — According to a report by Cybernews, the phone numbers of more than half a billion WhatsApp users have been leaked and put online for sale. The ... Read more »

Albert Pyun, cult filmmaker behind ‘Cyborg’ and ‘Sword and the Sorcerer,’ dies at 69

Albert Pyun, a genre filmmaker known for cult classics such as “The Sword and the Sorcerer” and “Cyborg,” has died. He was 69. The prolific writer-director died Saturday evening, according ... Read more »

How to upgrade laptop RAM what you need to know

Today, shares with you how upgrade laptop RAM very simple. 1. The right time to upgrade laptop RAM RAM is one of the important components of a laptop, and ... Read more »

Watch: Rams pull off fake punt vs. Chiefs

Watch: Rams pull off fake punt vs. Chiefs Johnny Hekker may not be on the Rams anymore, but their new punter sure can sling it, too. On Sunday against the ... Read more »

Bush-Era DHS Secretary Rips GOP Plan to Impeach Mayorkas: 'Political Stunt'

Above, Former Department of Homeland Security Secretary Michael Chertoff speaks during an event to mark the 15th anniversary of the Department of Homeland Security, March 1, 2018 in Washington, DC. ... Read more »

Wisconsin brings in Cincinnati's Luke Fickell as coach

Wisconsin brings in Cincinnati's Luke Fickell as coach Wisconsin has hired Luke Fickell as its next football coach, athletic director Chris McIntosh announced Sunday. Fickell led Cincinnati to the College Football ... Read more »

Disgraced former U.K. minister seeks TV redemption on ‘I’m A Celebrity … Get Me Out of Here’

LONDON —  Matt Hancock, the U.K.’s scandal-prone former health secretary, sought an unlikely form of redemption Sunday: attempting to win “I’m A Celebrity … Get Me Out of Here” — a ... Read more »

Top Three Moments From Day 8 of 2022 World Cup

Germany's Niclas Füllkrug, Costa Rica's Keysher Fuller and Moroccan substitutes Abdelhamid Sabiri and Zakaria Aboukhlal provided the top World Cup moments on Sunday Read more »

Eddie Jackson, Darnell Mooney Injuries Leave Bears Roster Thin

Many Bears injuries could provide biggest challenge yet originally appeared on NBC Sports Chicago The Bears were handed an ugly loss at MetLife Stadium when the Jets beat them handily ... Read more »

Ivica Zubac leads short-handed Clippers to win over Pacers

Even without Paul George, Kawhi Leonard and Luke Kennard, the Clippers’ game Sunday against the Indiana was theirs to lose. By the third quarter, the Clippers had already run away ... Read more »

These Awkward Family Photos Are So Bad They’re Good

Say cheese. Think your family photoshoot turned out poorly? You’re wrong. You’re so, so wrong. We aren’t sure whose idea these photos were, but someone should have stopped them. Or ... Read more »

Georgia runoff between Sen. Raphael Warnock, Herschel Walker grows increasingly bitter

Georgia runoff between Sen. Raphael Warnock, Herschel Walker grows increasingly bitter ASSOCIATED PRESS WARNER ROBINS, Ga. — Ads with the candidates’ ex-wives. Cries of “liar” flying in both directions. Stories ... Read more »

Disney's Former CEO Bob Chapek Reportedly Shifted Budgets to Cover Up Disney+'s Losses

Disney’s Former CEO Bob Chapek Reportedly Shifted Budgets to Cover Up Disney+’s Losses A recent bit of news that has shaken the entertainment and business world is the sudden removal ... Read more »

Viola Davis Shares The Best Advice Denzel Washington Ever Gave Her

Viola Davis (R) in teal dress smiling next to Denzel Washington, who is wearing a charcoal gray suit Viola Davis should be the one giving advice. After all, she is ... Read more »

World Cup: Canada breaks through for early score before losing to Croatia

AL RAYYAN, Qatar —  The last time Canada went to the World Cup, Diego Maradona was still playing, the Soviet Union made it to the round of 16 and synthetic balls ... Read more »

The Hollywood Christmas Parade celebrates its 90th anniversary

The Hollywood Christmas Parade will celebrate its 90th anniversary Sunday with live bands, colorful floats and, of course, the star of the evening: Santa Claus and his reindeer. This year’s ... Read more »

Column: Young teams get big chance in state bowl games

Lake Balboa Birmingham football players were lined up Saturday night to receive their City Section Open Division championship trophy at Valley College. Amid the celebration, it was a challenge trying ... Read more »

Car hauler catches fire on Pennsylvania Turnpike

A car hauler caught fire on the Pennsylvania Turnpike Sunday morning. According to PennDOT, the vehicle fire is affecting traffic between Exit 67 and Exit 57 on the shoulder right ... Read more »

NFL star Odell Beckham Jr. removed from Miami flight after refusing to comply with safety protocol, police say

NFL free agent wide receiver Odell Beckham Jr. was removed from a Los Angeles-bound American Airlines flight Sunday morning at Miami International Airport after refusing to comply with safety protocol, ... Read more »

2 Young Children Stabbed to Death in New York Apartment: Police

NBC New York Two small children were found fatally stabbed after their mother was taken into custody for observation Saturday night in New York City, police said. A 3-year-old boy ... Read more »

Justin Fields' Absence Felt by Bears in Blowout Loss Vs. Jets

Fields’ absence felt by Bears in blowout loss vs. Jets originally appeared on NBC Sports Chicago EAST RUTHERFORD, NJ — Justin Fields has been the rising tide to lift all ... Read more »

NYPD officers rescue malnourished dog, seven puppies in Queens; arrest owner

NYPD officers rescue malnourished dog, seven puppies in Queens; arrest owner QUEENS (PIX11) — NYPD officers in Queens rescued a severely malnourished Great Dane and her seven puppies during a ... Read more »

Former College Starting Quarterback Announces He's Transferring

ATLANTA, GA – NOVEMBER 02: A general view of Bobby Dodd Stadium during the game between the Georgia Tech Yellow Jackets and the Pittsburgh Panthers on November 2, 2013 in ... Read more »

I-75 lane and ramp closures scheduled for Interstate 75/Thru the Valley project

I-75 lane and ramp closures scheduled for Interstate 75/Thru the Valley project CINCINNATI (WKRC) – Several temporary I-75 lane and ramp closures will take effect soon as part of the Interstate ... Read more »

Democratic Sen. Chris Murphy questions law enforcement funding for 'Second Amendment sanctuaries'

Sen. Chris Murphy, D-Conn., said Sunday that there needs to be a “conversation” about whether to continue to fund law enforcement in a “Second Amendment sanctuary state” or counties that ... Read more »

Odell Beckham Jr escorted off plane by police in Miami, calls situation 'comedy hr'

The NFL’s most intriguing free agent, wide receiver Odell Beckham Jr., had an incident on a Miami flight that led to him being escorted off the plane by police. Beckham ... Read more »
Breaking thailand news, thai news, thailand news Verified News Story Network