Experts Warn of Stealthy PowerShell Backdoor Disguising as Windows Update

Aspects have emerged about a beforehand undocumented and totally undetectable (FUD) PowerShell backdoor that gains its stealth by disguising alone as part of a Windows update system.

“The covert self-formulated software and the connected C2 commands look to be the do the job of a innovative, mysterious risk actor who has targeted about 100 victims,” Tomer Bar, director of security investigate at SafeBreach, stated in a new report.

Attributed to an unnamed menace actor, attack chains involving the malware start with a weaponized Microsoft Term document that, for each the company, was uploaded from Jordan on August 25, 2022.

Metadata linked with the entice document signifies that the initial intrusion vector is a LinkedIn-dependent spear-phishing attack, which ultimately sales opportunities to the execution of a PowerShell script through a piece of embedded macro code.

The PowerShell script (Script1.ps1) is intended to hook up to a remote command-and-command (C2) server and retrieve a command to be launched on the compromised machine by implies of a 2nd PowerShell script (temp.ps1).

But an operational security error made by the actor by working with a trivial incremental identifier to uniquely recognize each and every victim (i.e., , 1, 2, etc.) permitted for reconstructing the commands issued by the C2 server.

Some of the notable commands issued consist of exfiltrating the listing of operating procedures, enumerating data files in specific folders, launching whoami, and deleting files below the general public user folders.

As of writing, 32 security distributors and 18 anti-malware engines flag the decoy document and the PowerShell scripts as malicious, respectively.

The conclusions arrive as Microsoft has taken actions to block Excel 4. (XLM or XL4) and Visible Fundamental for Programs (VBA) macros by default across Office applications, prompting risk actors to pivot to alternative delivery solutions.

Found this short article interesting? Follow THN on Facebook, Twitter  and LinkedIn to study extra exclusive content we post.

Some parts of this article are sourced from:
thehackernews.com