The Python-based malware, dubbed “Anubis Backdoor,” represents an evolution in the group’s tactics, techniques, and procedures (TTPs) that have historically caused billions in damages globally. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The key component, a script named “conf.py,” had remarkably low detection rates when first submitted to VirusTotal, demonstrating the effectiveness of the group’s obfuscation techniques. According to security researchers, what makes Anubis Backdoor particularly concerning is its minimal footprint and sophisticated anti-forensic capabilities. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. FIN7’s implementation demonstrates their continued evolution from earlier campaigns, using Python to create a backdoor that blends with normal system operations. The analysis revealed a multi-layered attack combining legitimate programming techniques with advanced obfuscation to mask malicious intent. The malware uses a combination of encryption, obfuscation, and temporary file execution that makes detection and analysis significantly more challenging. This sophisticated toolset provides FIN7 with flexible remote access capabilities that blend with legitimate network traffic, making it a formidable threat to organizations worldwide. The malware maintains persistence through Windows Registry, storing its command and control (C2) configuration under “HKEY_CURRENT_USER\Software\FormidableHandlers” or similar randomized key names. G Data researchers identified that initial infection occurs through a seemingly innocent ZIP archive containing multiple Python files, distributed via targeted phishing campaigns. Cybersecurity experts have identified a sophisticated new backdoor tool developed by the notorious financial cybercrime group FIN7. Communication with C2 servers happens over HTTP ports (80/443), with traffic obfuscation using Base64 encoding and custom alphabet substitution. The backdoor’s command set enables complete system control, including file operations, environment reconnaissance, and dynamic C2 updates. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 21 Mar 2025 15:30:19 +0000