Cybercriminals now using malware and adware to exploit virtual meeting apps

guest · Apr 9, 2020

ThreatList: Skype-Themed Apps Hide a Raft of Malware
April 8, 2020
https://threatpost.com/skype-apps-hide-malware/154566/

[...] Skype is the undisputed leader when it comes to being impersonated by malicious downloads, researchers have found.
An April analysis from Kaspersky uncovered a total of 120,000 suspicious malware and adware packages in the wild masquerading as versions of the video calling app.

It should be said that Skype isn’t alone in being targeted: The research found that among a total of 1,300 suspicious files not using the Skype name, 42 percent were disguised as Zoom, followed by WebEx (22 percent), GoToMeeting (13 percent), Flock (11 percent) and Slack (11 percent).

“Social meeting applications currently provide easy ways for people to connect via video, audio or text when no other means of communication are available. However, cyber-fraudsters do not hesitate to use this fact and try to distribute various cyberthreats under the guise of popular apps.”
Click to expand...

Some of the files found turned out to be simply knockoff versions of the real thing, but among the actual threats detected, a few malwares and file types came to the fore, including two adware families: DealPly and DownloadSponsor.

“Both families are installers that show ads or download adware modules,” according to the analysis. “Such software typically appears on users’ devices once they are downloaded from unofficial marketplaces.”
Click to expand...

guest · May 4, 2020

Hackers target remote workers with fake Zoom downloader
May 4, 2020
https://www.zdnet.com/article/hackers-target-remote-workers-with-fake-zoom-downloader/

But the need to work from home is something cyber criminals are attempting to take advantage of and now researchers at cybersecurity company TrendMicro have uncovered a new cyber criminal campaign attempting to exploit the current circumstances to trick remote workers into install RevCode WebMonitor RAT.

The researchers stress that the compromised software doesn't come from Zoom's own download centre or any official app stores -- rather the downloads come from malicious third-party websites. It's likely that victims are drawn towards the infected downloads by malicious links sent in phishing emails and other messages.
Once the file is downloaded, it runs an installer which delivers the video conferencing software as well as executing the WebMonitor remote access tool.

However, WebMonitor will terminate itself if executed in a virtual environment – a method of defence in an effort to prevent discovery and examination by security researchers. The RAT has been available on underground forums since mid-2017, but the commodity tool is still proving to be successful.
Click to expand...

The best way users can avoid falling victim to this kind of attack is by only downloading installers from official sources – and if you're sent a link to download an app, it's best to visit the official website and download it yourself.
Click to expand...

Trend Micro: WebMonitor RAT Bundled with Zoom Installer

When running the ZoomInstaller.exe, it drops a copy of itself named Zoom.exe. ZoomInstaller.exe will then open the process notepad.exe to run Zoom.exe.

It also drops the file Zoom.vbs into the Windows User Startup folder to enable automatic execution at every system startup. However, these processes will not proceed if it detects processes connected to certain debugging or security tools: [...]
Since the system downloaded a legitimate Zoom application version (4.6), it won’t make the users suspicious. However, the system has already been compromised at this point.
Click to expand...

guest · May 22, 2020

Hackers Use Fake Zoom Installers to Install Backdoor and Devil Shadow Botnet on Windows Computers
May 22, 2020
https://gbhackers.com/fake-zoom-installers-2/

Hackers taking advantage of the video conferencing apps like Zoom to infect systems with malicious routines.
Security researchers from Trend Micro observed two malware samples that pose as Zoom installers but when decoded it contains malware.
Fake Zoom Installers
The malware kills all the running remote utilities upon installation and opens TCP port 5650 to gain remote access to the infected system.
Another sample observed by researchers installs Devil Shadow Botnet, the infection starts with the malicious installer with the file named pyclient.cmd which contains malicious commands.

In another campaign, attackers repackaged the legitimate zoom installer with WebMonitor RAT. The infection starts with downloading the malicious file ZoomIntsaller.exe from malicious sources.
Click to expand...

Trend Micro: Backdoor, Devil Shadow Botnet Hidden in Fake Zoom Installers

We found two malware files that pose as Zoom installers but when decoded, contains the malware code. These malicious fake installers do not come from Zoom’s official installation distribution channels. One of the samples installs a backdoor that allows malicious actors to run malicious routines remotely, while the other sample involves the installation of the Devil Shadow botnet in devices.
Conclusion
These installers are hosted on suspicious websites and not from official marketplaces such as the Play Store, App Store, or Zoom’s own download center, which could be taken as a telltale sign of their maliciousness. Another observable sign is that the malicious installers drop and run the “legitimate Zoom installer” slower than the one official Zoom installation. The malicious versions take more time to run since they extract the malicious components before running Zoom.

The cybercriminals behind this malware may also be in the process of research and development; they’re using multiple components with a legitimate application to evade security programs.
Click to expand...

Log in or Sign up

Cybercriminals now using malware and adware to exploit virtual meeting apps

guest Guest

guest Guest

guest Guest

Log in or Sign up

Cybercriminals now using malware and adware to exploit virtual meeting apps

guest Guest

guest Guest

guest Guest

Useful Searches