Trojan-Riddled WinRAR, Winbox, IDM Spreads StrongPity Spyware

guest · Jul 17, 2019

Trojan-Riddled WinRAR, Winbox, IDM Spreads StrongPity Spyware
July 17, 2019
https://www.bleepingcomputer.com/ne...winrar-winbox-idm-spreads-strongpity-spyware/

Some versions of WinRAR file compression tool and Winbox software for managing MikroTik users have been tampered with to install malware serving an advanced threat actor. This campaign may have started in the second half of 2018 and continues today.
The operation has been attributed with high confidence to StrongPity, an APT-level adversary that specializes in watering hole attacks for cyber-espionage purposes.
Normal behavior in trojanized software
Victims would not notice anything out of order with the software piece as it looked and worked the same way as the legitimate variant.

The malware dropped this way is looking for documents and communicates with the command and control server over an SSL connection. It also provides remote access functionality, the researchers say in a report published today.
Click to expand...

Alien Labs: Newly identified StrongPity operations

itman · Jul 17, 2019

Another "supply chain" attack:

"The new malware samples have been unreported and generally appear to have been created and deployed to targets following a toolset rebuild in response to the above public reporting during the fourth quarter of 2018." - AT&T Alien Labs.
Click to expand...

Rasheed187 · Jul 20, 2019

Yes, these are the most scary attacks, because you think you're dealing with legit software, who even behave normally. So without some form of behavior monitoring it would be hard to detect abnormal behavior.

Log in or Sign up

Trojan-Riddled WinRAR, Winbox, IDM Spreads StrongPity Spyware

guest Guest

itman Registered Member

Rasheed187 Registered Member

Log in or Sign up

Trojan-Riddled WinRAR, Winbox, IDM Spreads StrongPity Spyware

guest Guest

itman Registered Member

Rasheed187 Registered Member

Useful Searches