Cybersecurity researchers have uncovered a surge in malware infections stemming from malvertising campaigns distributing a loader known as FakeBat.
“These assaults are opportunistic in nature, concentrating on customers searching for standard enterprise software program,” the Mandiant Managed Protection group stated in a technical report. “The an infection makes use of a trojanized MSIX installer, which executes a PowerShell script to obtain a secondary payload.”
FakeBat, additionally known as EugenLoader and PaykLoader, is linked to a risk actor named Eugenfest. The Google-owned risk intelligence group is monitoring the malware below the title NUMOZYLOD and has attributed the Malware-as-a-Service (MaaS) operation to UNC4536.
Assault chains propagating the malware make use of drive-by obtain strategies to push customers looking for standard software program towards bogus lookalike websites that host booby-trapped MSI installers. Among the malware households delivered by way of FakeBat embody IcedID, RedLine Stealer, Lumma Stealer, SectopRAT (aka ArechClient2), and Carbanak, a malware related to the FIN7 cybercrime group.
“UNC4536’s modus operandi entails leveraging malvertising to distribute trojanized MSIX installers disguised as standard software program like Courageous, KeePass, Notion, Steam, and Zoom,” Mandiant stated. “These trojanized MSIX installers are hosted on web sites designed to imitate respectable software program internet hosting websites, luring customers into downloading them.”
What makes the assault notable is the usage of MSIX installers disguised as Courageous, KeePass, Notion, Steam, and Zoom, which have the flexibility to execute a script earlier than launching the primary software by way of a configuration known as startScript.
UNC4536 is actually a malware distributor, that means FakeBat acts as a supply car for next-stage payloads for his or her enterprise companions, together with FIN7.
“NUMOZYLOD gathers system data, together with working system particulars, area joined, and antivirus merchandise put in,” Mandiant stated. “In some variants, it gathers the general public IPv4 and IPv6 deal with of the host and sends this data to its C2, [and] creates a shortcut (.lnk) within the StartUp folder as its persistence.”
The disclosure comes slightly over a month after Mandiant additionally detailed the assault lifecycle related to anther malware downloader named EMPTYSPACE (aka BrokerLoader or Vetta Loader), which has been utilized by a financially motivated risk cluster dubbed UNC4990 to facilitate knowledge exfiltration and cryptojacking actions concentrating on Italian entities.