As email gateways become better at spotting malicious messages, operators of the sinister BazarBackdoor malware are resorting to changing up their tactics.
According to reports from BleepingComputer, the TrickBot group, which created the malware, no longer tries to infect new endpoints directly via email, but rather through website contact forms.
Citing a report from cybersecurity experts Abnormal Security, the publication says the new campaign probably kicked off in December 2021, targeting corporate endpoints with Cobalt Strike or ransomware.
Deploying the BazarBackdoor DLL
The method is simple: instead of directly sending an email, the threat actor will use corporate contact forms to kick off communication, most often posing as a business requesting a product supply quote.
Once the target responds to the message, the attacker will send a malicious ISO file, claiming it’s relevant to the communication. The ISO file won’t be attached directly, though, but instead will first be uploaded to third-party file-sharing services, such as TransferNow or WeTransfer.
The ISO archive carries two files, the researchers suggest: one .lnk file and one .log file. By grouping these files together, and having the victim extract them manually after download, the threat actors hope to evade any email protection services that the target might have set up.
Once the target runs the .lnk file, it will open a terminal window and load the .log file - the BazarBackdoor DLL.
BazarBackdoor is built to provide its operators with remote access to an internal device, and as such, is usually used as a stepping stone towards the deployment of more destructive malware or ransomware.
Given that BazarBackdoor is the first stage in a multi-stage attack, the researchers expect the malware to deploy the stage-two payload. However, many of the C2 IPs are offline, preventing researchers from discovering the campaign’s endgame.
- You might want to check out our list of the best firewalls right now
Via BleepingComputer
