The attack began when an unsuspecting victim visited a malicious website mimicking Zoom’s official download page (zoommanager[.]com), where they downloaded what appeared to be a legitimate teleconferencing application installer. This tunneling technique allowed the threat actors to establish remote desktop connections through the compromised domain controller to access file servers, where they deployed WinRAR to archive sensitive data. The DFIR Report researchers noted that after downloading two ZIP archives from the command-and-control server, the malware executed both the legitimate Zoom installer (to maintain the illusion of normality) and the malicious payload. The sophisticated multi-stage attack chain, combined with the nine-day dwell time, demonstrates the threat actors’ patience and methodical approach to maximizing both data theft and encryption impact. After nine days of dwell time, the attack escalated when SectopRAT deployed both Brute Ratel (known as “Badgers”) and Cobalt Strike beacons across the network. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The weaponized installer, created using Inno Setup, contained a malicious downloader known as “d3f@ckloader” built on Pascal scripting language. The attackers then exfiltrated approximately 934 MB of data using the cloud storage service Bublup before deploying BlackSuit ransomware using PsExec for remote execution. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. These tools facilitated credential harvesting from LSASS memory and lateral movement using Windows remote service creation. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Cybercriminals recently leveraged a fake Zoom installer to deploy BlackSuit ransomware across an enterprise network. This initial stage established persistence by adding the installation directory to Windows Defender exclusions and marking files as hidden.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 31 Mar 2025 08:05:14 +0000