Hacker develops new 'Screenshotter' malware to find high-value targets

guest · Feb 9, 2023

Cybercrime Gang Uses Screenlogger to Identify High-Value Targets in US, Germany
By Bill Toulas @billtoulas - February 9, 2023

A new threat actor tracked as TA886 targets organizations in the United States and Germany with new custom malware to perform surveillance and data theft on infected systems.
Click to expand...

The previously unknown cluster of activity was first discovered by Proofpoint in October 2022, with the security firm reporting that it continued into 2023.

The threat actor appears to have financial motivations, performing a preliminary evaluation of breached systems to determine if the target is valuable enough for further intrusion.
Click to expand...

Surveilling victims before stealing data
The threat actor targets victims using phishing emails that include Microsoft Publisher (.pub) attachments with malicious macros, URLs linking to .pub files with macros, or PDFs containing URLs that download dangerous JavaScript files.

If the recipients of these emails click on the URLs, a multi-step attack chain is triggered, resulting in the download and execution of "Screenshotter," one of TA886's custom malware tools.
This tool takes JPG screenshots from the victim'svictim's machine and sends them back to the threat actor'sactor's server for review.
Click to expand...

The attackers then manually examine these screenshots and decide whether the victim is of value. This evaluation may include having the Screenshotter malware snap more screenshots or dropping additional custom payloads like:

A domain profiler script that sends AD (Active Directory) domain details to the C2

A malware loader script (AHK Bot loader) that loads an info-stealer into memory

Click to expand...

Proofpoint: Screentime: Sometimes It Feels Like Somebody's Watching Me

By Axel F - February 8, 2023
Key Findings

Proofpoint began tracking a new threat actor, TA866.

Proofpoint researchers first observed campaigns in October 2022 and activity has continued into 2023.

The activity appears to be financially motivated, largely targeting organizations in the United States and Germany.

With its custom toolset including WasabiSeed and Screenshotter, TA866 analyzes victim activity via screenshots before installing a bot and stealer.

Click to expand...

Log in or Sign up

Hacker develops new 'Screenshotter' malware to find high-value targets

guest Guest

Log in or Sign up

Hacker develops new 'Screenshotter' malware to find high-value targets

guest Guest

Useful Searches