The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media

guest · Jan 6, 2023

By Ravie Lakshmanan - January 5, 2023

The notorious information-stealer known as Vidar is continuing to leverage popular social media services such as TikTok, Telegram, Steam, and Mastodon as an intermediate command-and-control (C2) server.

"When a user creates an account on an online platform, a unique account page that can be accessed by anyone is generated," AhnLab Security Emergency Response Center (ASEC) disclosed in a technical analysis published late last month. "Threat actors write identifying characters and the C2 address in parts of this page."
In other words, the technique relies on actor-controlled throwaway accounts created on social media to retrieve the C2 address.
Click to expand...

Vidar, first identified in 2018, is a commercial off-the-shelf malware that's capable of harvesting a wide range of information from compromised hosts. It typically relies on delivery mechanisms like phishing emails and cracked software for propagation.

"After information collection is complete, the extorted information is compressed into a ZIP file, encoded in Base64, and transmitted to the C2 server," ASEC researchers said.
What's new in the latest version of the malware (version 56.1) is that the gathered data is encoded prior to exfiltration, a change from the previous variants that have been known to send the compressed file data in plaintext format.
Click to expand...

ASEC: Vidar Stealer Exploiting Various Platforms

Vidar Malware is one of the active Infostealers, and its distribution has been significantly increasing. Its characteristics include the use of famous platforms such as Telegram and Mastodon as an intermediary C2.

Even afterward, Vidar saw continuous version updates while actively being distributed. In the recent samples in circulation, various other platforms such as Steam and TikTok were used aside from Telegram and Mastodon. In this blog post, we aim to cover the details of these cases.
Click to expand...

Log in or Sign up

The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media

guest Guest

Log in or Sign up

The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media

guest Guest

Useful Searches