Fake DMCA complaints, DDoS threats lead to BazaLoader malware

guest · Aug 27, 2021

Fake DMCA complaints, DDoS threats lead to BazaLoader malware
August 27, 2021
https://www.bleepingcomputer.com/ne...ints-ddos-threats-lead-to-bazaloader-malware/

Cybercriminals behind the BazaLoader malware came up with a new lure to trick website owners into opening malicious files: fake notifications about the site being engaged in distributed denial-of-service (DDoS) attacks.

The messages contain a legal threat and a file stored in a Google Drive folder that allegedly provides evidence of the source of the attack.
Click to expand...

Fake legal threats
The DDoS theme is a variation of another lure, a Digital Millennium Copyright Act (DMCA) infringement complaint linking to a file that supposedly contains evidence about stealing images.

In submissions seen by BleepingComputer, the threat actor used Firebase URLs to push BazaLoader. The goal is the same though: use contact forms to deliver BazaLoader malware that often drops Cobalt Strike, which can lead to data theft or a ransomware attack.
Click to expand...

Website developer and designer Brian Johnson posted last week about two of his clients getting legal notifications about their websites being hacked to run DDoS attacks against a major company (Intuit, Hubspot).

The malicious sender also included a link to a file hosted in Google Drive claiming to provide evidence of the DDoS attack and its origin.
Proofpoint security researcher Matthew Mesa notes in a tweet that these messages are sent through the website’s contact form and deliver the BazaLoader malware hosted on a Google site.
Click to expand...

Log in or Sign up

Fake DMCA complaints, DDoS threats lead to BazaLoader malware

guest Guest

Log in or Sign up

Fake DMCA complaints, DDoS threats lead to BazaLoader malware

guest Guest

Useful Searches