Microsoft sounds the alarm over new cunning Windows malware

Date:
Wed, 13 Apr 2022 12:21:44 +0000

Description:
Tarrask malware uses hidden scheduled tasks to maintain persistence on a Windows device after restart.

FULL STORY ======================================================================

The Chinese state-sponsored threat actor Hafnium has been found using a brand new malware to maintain access on a breached Windows endpoint, with the help of hidden scheduled tasks, Microsoft has announced.

The Microsoft Detection and Response Team (DART) says the group has been leveraging a so far unknown vulnerability (a zero-day ) in its attacks.

"Investigation reveals forensic artifacts of the usage of Impacket tooling
for lateral movement and execution and the discovery of a defense evasion malware called Tarrask that creates 'hidden' scheduled tasks, and subsequent actions to remove the task attributes, to conceal the scheduled tasks from traditional means of identification, DART explained. Spotting the malware

Tarrask hides its activity from "schtasks /query" and Task Scheduler, by deleting any Security Descriptor registry value.

The Chinese criminals have been using these hidden tasks to re-establish the connection to C2 after the device restarts.

One of the ways to find the hidden tasks is to manually inspect Windows Registry for scheduled tasks without a Security Descriptor Value in their
Task Key, it was further explained.

Another way to spot the malware is to enable the Security.evtx and the Microsoft-Windows-TaskScheduler/Operational.evtx logs and look for key
events, in connection to any tasks "hidden" using Tarrask.

The Redmond giant has also recommended enabling logging for 'TaskOperational' in the Microsoft-Windows-TaskScheduler/Operational Task Scheduler log and keeping an eye out for outbound connections from critical Tier 0 and Tier 1 assets.

US warns Chinese hackers have their most advanced backdoor yet

Chinese hackers are reportedly now deploying malware on targets in Russia

This new custom macOS malware seizes control of your Google Drive account

"The threat actors in this campaign used hidden scheduled tasks to maintain access to critical assets exposed to the internet by regularly
re-establishing outbound communications with C&C infrastructure," DART says.

"We recognize that scheduled tasks are an effective tool for adversaries to automate certain tasks while achieving persistence, which brings us to
raising awareness about this oft-overlooked technique."

In the same announcement, Microsoft also added that Hafnium targeted the Zoho Manage Engine Rest API authentication bypass vulnerability, to place a Godzilla web shell with similar properties, something Unit42 previously discovered, as well.

Since August 2021, Microsoft adds, Hafnium has been targeting organizations
in the telecommunication, internet service provider and data services
sectors, concluding that the group broadened its scope of interest. Defend from ransomware with the best ransomware protection services around

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/microsoft-sounds-the-alarm-over-new-cunning-win dows-malware/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)