Cisco researchers spotlight Solarmarker malware

guest · Jul 30, 2021

Cisco researchers spotlight Solarmarker malware
July 30, 2021
https://www.zdnet.com/article/cisco-researchers-spotlight-solarmarker-malware/

Andrew Windsor and Chris Neal, researchers with Cisco Talos, have seen new activity from Solarmarker, a .NET-based information stealer and keylogger that they called "highly modular."

The researchers explained that the Solarmarker campaign is being conducted by "fairly sophisticated" actors focusing their energy on credential and residual information theft.
Click to expand...

Like the targeted language component of the keylogger, other clues indicate that the cyber-attacker has an interest in European organizations or cannot afford to process text in any languages other than Russian, German and English.

"Regardless, they are not particular or overly careful as to which victims are infected with their malware. During this recent surge in the campaign, Talos observed the health care, education, and municipal governments verticals being targeted the most often," the report said.
Click to expand...

Cisco noted that the malware was previously used alongside "d.m," but is now being used with the "Mars" staging module. Researchers also discovered another module, previously unreported, that they named "Uranus."

"Talos is actively tracking a malware campaign with the Solarmarker information-stealer dating back to September 2020, the report said. "Some DNS telemetry and related activity even point back to April 2020. At the time, we discovered three primary DLL components and multiple variants utilizing similar behavior."

"The Jupyter information stealer is Solarmarker's second most-dropped module. [...]"
The attackers also use a keylogger called "Uran", which was discovered in older campaigns.
Click to expand...

Cisco Talos: Threat Spotlight: Solarmarker

Executive summary

Cisco Talos has observed new activity from Solarmarker, a highly modular .NET-based information stealer and keylogger.

A previous staging module, "d.m," used with this malware has been replaced by a new module dubbed "Mars."

Another previously unreported module named "Uranus" has been identified.

The threat actor behind Solarmarker continues to evolve while remaining relatively undetected.

Cisco Talos has created full coverage in response to this evolving threat, protecting Cisco customers

Click to expand...

Log in or Sign up

Cisco researchers spotlight Solarmarker malware

guest Guest

Log in or Sign up

Cisco researchers spotlight Solarmarker malware

guest Guest

Useful Searches