Hackers target 7ZIP due to its widespread use and popularity, making it a lucrative vector for spreading malware.
Exploiting vulnerabilities in 7ZIP allows them to compromise a large number of systems, potentially leading to unauthorized access or data theft.
Cybersecurity researchers at QiAnXin Threat Intelligence Center recently discovered that hackers are actively targeting 7ZIP to deliver or spread malware via the Microsoft App Store.
Microsoft quickly removed malicious software from its App Store after researchers reported it.
The rogue package, named UTG-Q-003, went undetected for almost a year since its January 2023 appearance.
It's unknown how attackers uploaded the package.
The 7z-soft software was first downloaded on March 17, 2023, according to QiAnXin's data platform.
JPHP, an open-source project, uses Java to run PHP code, evading detection effectively.
Attackers kept changing payloads on their C2 server for extended evasion.
Exe had multiple download methods, and URLs are now inaccessible.
Both domains were WordPress sites, suggesting UTG-Q-003 invaded WordPress to store payloads and redirect webpages.
Despite browser closure, Windows notifications can still deliver links.
Initial phishing emails prompt enabling message notifications, evading email gateway detection.
In the second stage, tailored phishing links exploit the target host's platform.
UTG-Q-003 delivers JPHP framework-based installation packages.
Downloads surged on the Microsoft App Store, potentially tied to the WinRAR vulnerability.
After the CVE-2023-38831 disclosure, East Asian APT groups initiated phishing attacks in China.
SEO manipulation and difficulty finding 7zip on official sites push users to the Microsoft App Store, leading to compromise.
Russian package gets negative reviews from Chinese users, highlighting China's software download challenges.
The attacker domains link to Russia and Ukraine, preventing attribution, especially in Russian-speaking regions.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 14 Dec 2023 07:15:11 +0000