PYSA ransomware backdoors education orgs using ChaChi malware

guest · Jun 23, 2021

PYSA ransomware backdoors education orgs using ChaChi malware
June 23, 2021
https://www.bleepingcomputer.com/ne...ackdoors-education-orgs-using-chachi-malware/

The PYSA ransomware gang has been using a remote access Trojan (RAT) dubbed ChaChi to backdoor the systems of healthcare and education organizations and steal data that later gets leveraged in double extortion ransom schemes.

ChaChi is a custom Golang-based RAT malware developed in early 2020 deployed by PYSA operators to access and control infected systems.
Click to expand...

The RAT was first observed in the wild as a tool lacking obfuscation, port-forwarding, and DNS tunneling capabilities. However, its creators upgraded it to include all these features as observed when analyzing samples detected in subsequent attacks.

"After initial sightings in attacks during the first quarter of 2020, ChaChi’s code was altered to include obfuscation and persistence in late March or early April," the BlackBerry Threat Research and Intelligence Team says in a report shared in advance with BleepingComputer.
"Very soon after that, we started seeing ChaChi variants with the added DNS tunnelling and Port-Forwarding/Proxy functionality."
Click to expand...

BlackBerry Threat Research: PYSA Loves ChaChi: a New GoLang RAT

ChaChi is another entry in the expanding list of malicious software written in Go, also known as Golang, which is a relatively young programming language. As this is such a new phenomenon, many core tools to the analysis process are still catching up. This can make Go a more challenging language to analyze.
Click to expand...

Log in or Sign up

PYSA ransomware backdoors education orgs using ChaChi malware

guest Guest

Log in or Sign up

PYSA ransomware backdoors education orgs using ChaChi malware

guest Guest

Useful Searches