KPOT Stealer Reaches Version 2.0 and Brings New Features

guest · May 10, 2019

KPOT Stealer Reaches Version 2.0 and Brings New Features
May 10, 2019
https://www.technadu.com/kpot-stealer-version-2-0-new-features/67140/

The KPOT stealer is one dangerous piece of malware targeting account information and other sensitive user data by monitoring and intercepting messenger apps, web browser, email, and even VPN traffic data.

Already, Proofpoint researchers have spotted email campaigns that try to spread the new KPOT, taking advantage of the CVE-2017-11882 exploit through RTF documents that are attached to the emails. There’s also an intermediate downloader that fetches a malicious Powershell script which includes a Base64-encoded payload.

The takeaway is that particularly capable stealers like the KPOT are now as cheap as $100, which makes their deployment more accessible and potentially widespread than ever. KPOT v2.0 may be able to exploit a broad spectrum of applications, but it’s important to remember that it all starts with you opening an unsolicited email.

Don’t click on links found in email messages that come from addresses that you don’t recognize, don’t download attachments, and don’t run executables.
Click to expand...

Proofpoint: New KPOT v2.0 stealer brings zero persistence and in-memory features to silently steal credentials

guest · Nov 4, 2020

REvil ransomware gang 'acquires' KPOT malware
November 4, 2020
https://www.zdnet.com/article/revil-ransomware-gang-acquires-kpot-malware/

The operators of the REvil ransomware strain have "acquired" the source code of the KPOT trojan in an auction held on a hacker forum last month.

The sale took place after the KPOT malware author decided to auction off the code, desiring to move off to other projects.
The sale was organized as a public auction on a private underground hacking forum for Russian-speaking cyber-criminals, security researcher Pancak3 told ZDNet in an interview last month.

The only bidder was UNKN, a well-known member of the REvil (Sodinokibi) ransomware gang, Pancak3 said.
Click to expand...

The REvil operator received the source code of KPOT 2.0, the latest version of the KPOT malware.

Pancak3, who first spotted the KPOT auction in mid-October, told ZDNet that he believes the REvil gang bought KPOT to "further develop it" and add it to its considerable arsenal of hacking tools the gang uses during its targeted intrusions inside corporate networks.
Click to expand...

Log in or Sign up

KPOT Stealer Reaches Version 2.0 and Brings New Features

guest Guest

guest Guest

Log in or Sign up

KPOT Stealer Reaches Version 2.0 and Brings New Features

guest Guest

guest Guest

Useful Searches