DeathStalker's VileRAT Continues to Target Foreign and Crypto Exchanges

guest · Aug 10, 2022

August 10, 2022

The threat actor known as DeathStalker has continued to target and disrupt foreign and cryptocurrency exchanges around the world throughout 2022 using the VileRAT malware, according to security researchers from Kaspersky.

The findings are detailed in an advisory published on August 10 2022, which mentions a number of VileRAT-focussed campaigns supposedly perpetrated by DeathStalker, starting in September 2020, through 2021 and more recently in June 2022.

“DeathStalker has indeed continuously leveraged and updated its VileRAT toolchain against the same type of targets since we first identified it in June 2020,” reads the advisory.
“We have indeed been able to identify more samples of VileRAT-associated malicious files and new infrastructure since March 2022, which may be a symptom of an increase in compromise attempts.”
Click to expand...

After initial infection, DeathStalker would deliver an obfuscated JavaScript file to infected machines that would drop and schedule the execution of VileLoader, the VileRAT installer.

“Escaping detection has always been a goal for DeathStalker, for as long as we’ve tracked the threat actor,” the security researchers wrote.
Click to expand...

At the same time, Kaspersky concluded that because of VileRAT’s heavy payload, simple infection vectors, and several suspicious communication patterns, an efficient endpoint protection solution should be able to detect and block most of its malicious activities.
Click to expand...

Kaspersky: VileRAT: DeathStalker’s continuous strike at foreign and cryptocurrency exchanges

In late August 2020, we published an overview of DeathStalker’s profile and malicious activities, including their Janicab, Evilnum and PowerSing campaigns (PowerPepper was later documented in 2020). Notably, we exposed why we believe the threat actor may fit a group of mercenaries, offering hack-for-hire services, or acting as an information broker to support competitive and financial intelligence efforts.

DeathStalker has indeed continuously leveraged and updated its VileRAT toolchain against the same type of targets since we first identified it in June 2020.
Click to expand...

Log in or Sign up

DeathStalker's VileRAT Continues to Target Foreign and Crypto Exchanges

guest Guest

Log in or Sign up

DeathStalker's VileRAT Continues to Target Foreign and Crypto Exchanges

guest Guest

Useful Searches