InvisiMole: surprisingly equipped spyware, undercover since 2013

Minimalist · Jun 7, 2018

This is the modus operandi of the two malicious components of InvisiMole. They turn the affected computer into a video camera, letting the attackers see and hear what’s going on in the victim’s office or wherever their device may be. Uninvited, InvisiMole’s operators access the system, closely monitoring the victim’s activities and stealing the victim’s secrets.

Our telemetry indicates that the malicious actors behind this malware have been active since at least since 2013, yet the cyber-espionage tool was never analyzed nor detected until discovered by the ESET products on compromised computers in Ukraine and Russia.
Click to expand...

https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/

itman · Jun 7, 2018

The campaign is highly targeted – no wonder the malware has a low infection ratio, with only a few dozen computers being affected.
Click to expand...

Great example of if you're targeted by an advanced threat actor, you're pretty much "dead meat."

guest · Jun 18, 2020

InvisiMole malware delivered by Gamaredon hacker group
June 16, 2020
https://www.bleepingcomputer.com/ne...-malware-delivered-by-gamaredon-hacker-group/

Security researchers have demystified the attack chain of the elusive InvisiMole cyberespionage group, revealing a complicated multi-stage format that relies on vulnerable legitimate tools, target-specific encryption of payloads, and stealthy communication.

InvisiMole gets access to the target network through Gamaredon, a threat actor linked to Russia that runs reconnaissance operations and identifies valuable systems.
Click to expand...

By collaborating with the victims, the researchers were able to map four execution chains, used according to the privilege level on the compromised machine and the Windows version installed. The longest one requires six steps before deploying the final payload.
To keep the operation undetected, the threat actor used vulnerable executables of legitimate tools, such as the Total Video Player, SpeedFan utility, or the wdigest.dll in Windows.
New TCP and DNS downloaders
Hromcová notes in a blog post today that only select computers on the network would be infected with InvisiMole. The triage is likely done by Gamaredon, which also drops the more sophisticated malware from InvisiMole.
Click to expand...

ESET: Digging up InvisiMole’s hidden arsenal

In this blogpost, we summarize the findings published in full in our white paper, InvisiMole: The hidden part of the story.
Click to expand...

Log in or Sign up

InvisiMole: surprisingly equipped spyware, undercover since 2013

Minimalist Registered Member

itman Registered Member

guest Guest

Log in or Sign up

InvisiMole: surprisingly equipped spyware, undercover since 2013

Minimalist Registered Member

itman Registered Member

guest Guest

Useful Searches