New Ursnif Variant Likely Shifting Focus to Ransomware and Data Theft

The Ursnif malware has develop into the hottest malware to get rid of its roots as a banking trojan to revamp alone into a generic backdoor capable of providing upcoming-phase payloads, joining the likes of Emotet, Qakbot, and TrickBot.

“This is a major shift from the malware’s first reason to allow banking fraud, but is dependable with the broader menace landscape,” Mandiant scientists Sandor Nemes, Sulian Lebegue, and Jessa Valdez disclosed in a Wednesday analysis.

The refreshed and refactored variant, 1st spotted by the Google-owned menace intelligence agency in the wild on June 23, 2022, has been codenamed LDR4, in what is being noticed as an attempt to lay the groundwork for opportunity ransomware and knowledge theft extortion functions.

Ursnif, also named Gozi or ISFB, is one of the oldest banker malware family members, with the earliest documented assaults going as considerably again as 2007. Check Point, in August 2020, mapped the “divergent evolution of Gozi” about the yrs, though pointing out its fragmented growth historical past.

Virtually a year later on in late June 2021, a Romanian threat actor, Mihai Ionut Paunescu, was arrested by Colombian regulation enforcement officials for his part in propagating the malware to no less than a million personal computers from 2007 to 2012.

The most recent attack chain detailed by Mandiant demonstrates the use of recruitment and invoice-connected email lures as an original intrusion vector to download a Microsoft Excel doc, which then fetches and launches the malware.

The key refurbishment of Ursnif eschews all its banking-related features and modules in favor of retrieving a VNC module and getting a distant shell into the compromised machine, which are carried out by connecting to a remote server to get stated instructions.

“These shifts might mirror the menace actors’ elevated focus towards collaborating in or enabling ransomware operations in the upcoming,” the researchers explained.

Located this article intriguing? Follow THN on Fb, Twitter  and LinkedIn to read much more special articles we put up.

Some parts of this article are sourced from:
thehackernews.com