This advanced new malware strain leaves you practically defenceless

Date:
Tue, 07 Jun 2022 18:54:44 +0000

Description:
Kaspersky warns WinDealer gathers an "impressive" amount of data, and is distributed via a man-on-the-side attacks

FULL STORY ======================================================================

An extremely potent malware, delivered in a way thats immune to most cybersecurity measures, was discovered infecting high-profile Chinese individuals.

Cybersecurity researchers from Kaspersky have discovered malware they call WinDealer, distributed and used by a Chinese Advanced Persistent Threat (APT) actor called LuoYu. WinDealer, the researchers say, is capable of collecting an impressive amount of information. It can view and download any files
stored on the device, as well as run a keyword search on all the documents.

To deliver the malware to the target endpoint , the attackers perform a man-on-the-side attack, essentially hijacking in-transit network traffic.

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 . Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/10.99. Racing with the server

When the victim tries to access a certain resource on the internet (for example, open their LinkedIn account), they need to send a request to the server, to open the page. This request is the type of traffic that the attackers can intercept and read, and then try to deliver malicious content before the server responds with the legitimate site.

Kaspersky describes the method as a race with the legitimate server, the only difference being - the attacker has as many attempts to deliver malicious content as they want. In order to successfully infect a target endpoint, the attacker needs no interaction with the victim, whatsoever. Read more

Chinese hackers have been running riot on unsecured Windows devices

US warns Chinese hackers have their most advanced backdoor yet

Everyone's favorite media player abused to launch malware attacks

Targets are mostly high-profile organizations and individuals in China, the researchers further claim. Foreign diplomatic organizations established in China, members of the academic community, defense, logistics, and telecommunications companies, are all listed as potential targets. Besides China, Kaspersky researchers have also mentioned targets in Germany, Austria, the US, the Czech Republic, Russia, and India.

All of the targets are using Windows as their operating system of choice.

Besides being difficult to spot, the malware is also difficult to block. Usually, this type of malware contacts a command & control (C2) server for instructions, and simply blocking the IP address of the server would be
enough to neutralize the threat. WinDealer, on the other hand, relies on a complex algorithm that generates IP addresses (48,000, Kaspersky says),
making blocking impossible.

The only way to defend against such an attack is to route the traffic through another network, for example with a VPN. However, having a VPN in China is easier said than done. Stay safe from Chinese APTs with the best ransomware protection services out there



======================================================================
Link to news story: https://www.techradar.com/news/this-advanced-new-malware-strain-leaves-you-pra ctically-defenceless/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)