Cybersecurity professionals are being targeted by malicious GitHub repositories that masquerate as tools for scanning networks, testing security, and analyzing logs. Researchers at Dr. Web say the campaign has compromised more than 2,000 Windows systems, delivering backdoors, cryptocurrency-stealing malware, and information stealers.
The campaign began nearly two years ago by targeting cryptocurrency wallet users. More recently, the attackers shifted their focus to cybersecurity professionals and published repositories designed to appear useful for automating scanning, security testing, and log analysis.
One repository identified by Dr. Web contained a fake script promoted as a lightweight tool for parsing, cleaning, and formatting output from the Fscan network scanner.
Source: GitHub
Earlier lures included blockchain games, bots, and cheat tools, which generally targeted blockchain and gaming enthusiasts.
Malware hidden in project files
Dr. Web’s investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files. The code was concealed behind long stretches of white space, an old technique that remains effective.
In some Visual Studio projects, pre-build event routines execute code before compilation, according to Dr. Web researchers.
The infection chain uses PowerShell to obtain an encrypted download link. That link retrieves a modular, Electron-based loader named “Microsoft.exe.”
Source: Doctor Web
The loader establishes persistence on the infected computer, attempts to escalate its privileges, disables Windows security and recovery features, and injects the next malware stage into legitimate processes.
Multiple evasion techniques
Dr. Web identified six evasion techniques used in the loader’s default Mode3 operating mode:
- Making Explorer.exe appear to be the malware’s parent process.
- Disabling Smart App Control by changing Windows Registry values.
- Restoring the original ntdll.dll code from disk to remove hooks added by security software.
- Executing Windows system calls directly, making them harder for security tools to intercept.
- Patching EtwEventWrite in memory to suppress event tracing in affected processes.
- Patching AmsiScanBuffer in memory to interfere with antivirus scanning of scripts.
If Mode3 fails to launch, the loader switches to Mode2. In that mode, it adds exclusions to Microsoft Defender, uses a PowerShell script to decrypt the payload, and injects it into RegAsm.exe.
AsyncRAT and information-stealing malware
The final payload delivered to infected systems includes the AsyncRAT backdoor, Clipper malware that replaces cryptocurrency wallet addresses in the clipboard, and an information stealer.
The information stealer collects browser data, VPN settings, FTP client configuration files, game account data, and Discord tokens. It also steals information through Telegram bots.
According to Dr. Web, the malware removes ESET, McAfee, and Malwarebytes antivirus products from infected computers, attempts to disconnect the systems from update servers, and interferes with Windows backups.
Source: Doctor Web
Researchers also found a seemingly unfinished component that could help keep the loader running and download it again if it is deleted from the computer’s disk. The discovery suggests that the attackers may be continuing to develop the malware and add new capabilities.
Dr. Web has shared a complete list of indicators of compromise observed in the campaign.
Source: www.bleepingcomputer.com