Hackers are utilizing code from a Python clone of Microsoft's venerable Minesweeper game to hide malicious scripts in attacks on European and US financial organizations.
Ukraine's CSIRT-NBU and CERT-UA attribute the attacks to a threat actor tracked as 'UAC-0188,' who is using the legitimate code to hide Python scripts that download and install the SuperOps RMM. Superops RMM is a legitimate remote management software that gives remote actors direct access to the compromised systems.
CERT-UA reports that research following the initial discovery of this attack revealed at least five potential breaches by the same files in financial and insurance institutions across Europe and the United States.
The recipient is prompted to download a 33MB.SCR file from the provided Dropbox link.
This file contains innocuous code from a Python clone of the Minesweeper game along with malicious Python code that downloads additional scripts from a remote source.
Including Minesweeper code within the executable serves as a cover for the 28MB base64-encoded string containing the malicious code, attempting to make it appear benign to security software.
The base64 string is decoded to assemble a ZIP file that contains an MSI installer for SuperOps RMM, which is eventually extracted and executed using a static password.
SuperOps RMM is a legitimate remote access tool, but in this case it is used to grant the attackers unauthorized access to the victim's computer.
The agency has also shared additional indicators of compromise associated with this attack at the bottom of the report.
Fake job interviews target developers with new Python backdoor.
Firebird RAT creator and seller arrested in the U.S. and Australia.
New Brokewell malware takes over Android devices, steals data.
Russian Sandworm hackers targeted 20 critical orgs in Ukraine.
Visa warns of new JSOutProx malware variant targeting financial orgs.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sun, 26 May 2024 22:59:04 +0000