ESET experts reported that the BlackLotus UEFI bootkit, which is sold on hacker forums for about $ 5,000, is indeed capable of bypassing Secure Boot protection.

According to researchers, the malware poses a threat even to fully updated machines running Windows 11 with UEFI Secure Boot enabled.

Let me remind you that we also wrote that Experts discovered ESPecter UEFI bootkit used for espionage, and also that The expert told how he hacked into a nuclear power plant.

BlackLotus was first spotted in October 2022. Its seller claimed that the bootkit had a built-in Secure Boot bypass, built-in Ring0/Kernel deletion protection, and also ran in recovery mode and safe mode.

In addition, the seller claimed that the malware is equipped with anti-virtualization, anti-debugging and obfuscation, which complicates its detection and analysis. Also, according to his statements, the security software cannot detect and destroy the bootkit, since it runs under the SYSTEM account inside a legitimate process.

In addition, Black Lotus is allegedly capable of disabling security mechanisms on target machines, including Hypervisor-Protected Code Integrity (HVCI) and Windows Defender, as well as bypassing User Account Control (UAC).

The experts who discovered it wrote that Black Lotus has a size of 80 kilobytes, is written in assembler and C, and can determine the geofence of the victim in order to avoid infecting machines in the CIS countries. The malware is offered for sale for $5,000, and each new version will cost another $200.

Let me remind you that at that time the experts admitted that all the above features of Black Lotus are nothing more than a publicity stunt, and in reality the bootkit is far from being so dangerous. Unfortunately, these assumptions were not confirmed.

As ESET information security experts, who have been studying the malware since last fall, now report, rumors that the bootkit easily bypasses Secure Boot “have now become a reality”. According to them, the malware uses a year-old vulnerability CVE-2022-21894 to bypass Secure Boot and gain a foothold in the system.

Chronology from vulnerability to bootkit

Microsoft fixed this issue back in January 2022, but attackers can still exploit it because the affected signed binaries were not added to the UEFI revocation list. According to analysts, this is the first documented case of abuse of this vulnerability.

Most likely, information security specialists mean attacks like BYOVD – bring your own vulnerable driver.

Even worse, the PoC exploit for this vulnerability has been available since August 2022, so other cybercriminals may soon take advantage of the problem.

The exact way the bootkit is deployed is still unclear, but the attack begins with the installer component, which is responsible for writing files to the EFI system partition, disabling HVCI and BitLocker, and then rebooting the host.

The researchers say that after exploiting CVE-2022-21894, Black Lotus disables protection mechanisms, deploys a kernel driver and an HTTP loader. The kernel driver, among other things, protects the bootkit files from deletion, while the bootloader communicates with the control server and executes the payload.

While the researchers do not link the malware to any particular hack group or government, they note that the Black Lotus installers they analyzed will not work if the infected computer is located in Armenia, Belarus, Kazakhstan, Moldova, Romania, Russia, and Ukraine.

The post BlackLotus UEFI Bootkit Bypasses Protection even in Windows 11 appeared first on Gridinsoft Blog.

ESET experts have discovered the FatalRAT malware, which targets Chinese-speaking users: the threat is distributed through fake websites of popular applications and advertised through Google Ads.

Let me remind you that we also wrote about Attackers Can Use GitHub Codespaces to Host and Deliver Malware, and you may also be interested in our article: Dangerous Virus & Malware Threats in 2023.

The researchers say that FatalRAT has been active since at least the summer of 2021 and is capable of intercepting keystrokes, changing the victim’s screen resolution, downloading and running files, executing arbitrary shell commands, and stealing or deleting data stored in browsers.

Malware advertising

So far, the malware distribution campaign has not been linked to any known hacker group, and the ultimate goals of the attackers are also unclear. For example, hackers can steal victim information (such as credentials) for sale on darknet forums or for later use in other malicious campaigns.

According to experts, most of the attacks were observed between August 2022 and January 2023 and targeted users in Taiwan, China and Hong Kong.

A small number of infections have also been reported in Malaysia, Japan, Thailand, Singapore, Indonesia, Myanmar and the Philippines.

Basically, hackers distribute their malware through fake websites of popular applications, masquerading as Google Chrome, Mozilla Firefox, Telegram, WhatsApp, LINE, Signal, Skype, Electrum, Sogou Pinyin Method, Youdao and WPS Office. Some sites offer fake versions of applications in Chinese, when in fact these applications are not available at all in China (eg Telegram).

Fake site

To lure users to malicious sites, hackers promote these sites in Google search results through Google Ads, while trying to make fake domain sites look like real ones. These malicious ads have now been removed.

The ESET report notes that Trojanized installers downloaded from fake sites delivered the real application to the victim’s device to avoid detection, as well as the files needed to run FatalRAT. The installers themselves were digitally signed .MSI files created with the Windows installer.

According to the researchers, this campaign was aimed at the widest possible range of users and could affect anyone.

Let me remind you that the media wrote that Google Scammer Pleads Guilty in $123 Million Theft.

The post FatalRAT Malware Masks As Popular Apps in Google Ads appeared first on Gridinsoft Blog.

What is MSIL/Microsoft.Bing.A detection?

Around the first week of November 2022, many ESET antivirus software users started seeing an unusual detection. Their program was stubbornly reporting about a threat detected in an ordinary file – BingWallpaperApp.exe, which, as you can guess by its name, belongs to a Bing Wallpaper app. It is a genuine program, issued and signed by Microsoft, that offers dynamic wallpaper change for users’ desktops. VirusTotal shows that this file is clear and distributed by Microsoft.

However, that did not stop ESET from showing that detection. Its appearance is not a false positive, as ESET forum administration assures. Hence, someone found its functions malicious and added it to a detection database. The same administrator also said that their team has already messaged Microsoft with their statements and requirements to remove the detection. The funny moment is that despite being detected, the file cannot be removed properly, as the directory it is located in is protected by Windows. Thus, you’d see the notifications like “File could not be cleaned”.

The peculiar thing is that the detected application is supplied along with the newest Windows 11 version – 22H2. Therefore, updating your PC to that version or installing a fresh Win11 distribution having ESET onboard will lead to constant detection pop-ups. Neither ESET nor Microsoft say a word about the real reasons for such a situation, despite the story being active for over a week. Some say that the reason for such a decision is the fact that the Wallpaper app offers to set Bing as the default search engine – but that offer is pretty clear and can be declined, contrary to what is usually counted as a reason to consider unwanted applications.

What can I do with BingWallpaperApp.exe detection?

Not much, but at least you can make them much less often. First and foremost, you can remove the program manually, through one of the regular ways. The Bing Wallpaper app is not concealed in any way, so you will find it in the list of apps on your computer. If you can’t find it for some reason, it will appear in the system apps list, available in the default Appwiz utility.

However, not all people acknowledge the Wallpaper app from the antivirus detection popup. For those who use the program, the way to get rid of the MSIL/Microsoft.Bing.A detection is to set it as a false positive in the antivirus settings. It is not clear how quickly ESET and Microsoft will reach a consensus, so it may be a convenient temporary solution. That way, the security solution will keep detecting the file but have to ignore it as you forced it to do so.

The post MSIL/Microsoft.Bing.A Detection (BingWallpaperApp.exe) appeared first on Gridinsoft Blog.

The malware received its name due to the fact that it uses pCloud, Dropbox and Yandex.Disk cloud storages as control servers.

Let me remind you that we also wrote that Vulnerability in macOS Leads to Data Leakage, and also that Microsoft Releases PoC Exploit to Escape MacOS Sandbox.

The capabilities of CloudMensis indicate that the main goal of its operators is to collect confidential information from infected machines. For example, the malware is capable of taking screenshots, stealing documents, intercepting keystrokes, and compiling lists of emails, attachments, and files stored on removable media.

CloudMensis supports dozens of different commands, which allows its operators to perform a variety of actions on infected machines:

1. change in the malware configuration the cloud storage provider and authentication tokens, file extensions of interest, the frequency of polling cloud storage, and so on;
2. make a list of running processes;
3. to capture the screen;
4. make a list of letters and attachments;
5. make a list of files on removable media;
6. run shell commands and upload the result to the cloud storage;
7. download and execute arbitrary files.

According to ESET analysis, attackers infected the first Mac as early as February 4, 2022. Since then, they have only occasionally used the backdoor to compromise other machines, hinting at the targeted nature of this campaign.

Interestingly, once deployed, CloudMensis is able to bypass the Transparency Consent and Control (TCC) system, which asks the users if they need to grant the app permission to take screenshots or monitor keystrokes. The TCC mechanism is designed to block access to sensitive user data, allowing macOS users to customize privacy settings for various applications and devices (including microphones and cameras).

Rules created by the user are stored in a database protected by System Integrity Protection (SIP), which ensures that only the TCC daemon can modify them. Thus, if a user has disabled SIP on the system, CloudMensis will grant itself the necessary permissions by simply adding new rules to TCC.db.

However, even if SIP is enabled and any version of macOS Catalina prior to 10.15.6 is installed on the machine, CloudMensis can still gain the necessary rights by exploiting a vulnerability in CoreFoundation, which has the identifier CVE-2020-9934 and which Apple fixed two years ago. This bug will force the TCC daemon (tccd) to load a database that CloudMensis can write to.

The vector of infection, as well as the goals of the hackers, are still unknown, but the researchers write that, judging by the way the attackers handle Objective-C, they are practically unfamiliar with macOS. At the same time, experts admit that CloudMensis is still a powerful spy tool that can pose a serious threat to potential victims.

The post CloudMensis Malware Attacks MacOS Users appeared first on Gridinsoft Blog.

According to experts, Chinese “government” hackers from the Mustang Panda group (aka HoneyMyte, Bronze President, RedDelta and TA416) are behind the attacks.

Let me remind you that we wrote that Hacker groups split up: some of them support Russia, others Ukraine, and also that, for example, RuRansom Malware Destroys Data in Russian Systems, so perhaps the Chinese hackers simply chose a side.

This hacker group has been active since at least July 2018, and most often its attacks target various regions of Southeast Asia, although sometimes hackers are also interested in targets from Europe and the United States.

Secureworks reports that this time the Mustang Panda is exhibiting unusual behavior as the attackers now appear to have focused on Russian military personnel and officials working near the border with China. In their phishing baits, hackers exploit the theme of Russia’s invasion of Ukraine: malicious documents are written in English and disguised as data published by the EU on sanctions against Belarus.

Such lures are .exe executable files, but disguised as PDF documents and are named in Russian – “Blagoveshchensk – Blagoveshchensk border detachment.” The question arises why the document named in Russian contains the text in English, but the logic of the hackers in this matter has remained a mystery to researchers. Secureworks specialists came to only one clear conclusion: the target of this campaign is Russian officials or the military in the border region.

Running the executable extracts many additional files, including the decoy document itself, which can be seen in the screenshot above, a malicious DLL loader, an encrypted version of the PlugX (aka Korplug) malware, and another .exe file.

PlugX is the main tool of hackers; it is a remote access Trojan for Windows that allows to execute various commands on infected systems, steal files, install backdoors and additional malicious payloads. Several Chinese hack groups have been relying on this malware for many years.

It should be noted that the results of the Secureworks study complement the reports of Proofpoint and ESET, released last month. They detailed the use of a new PlugX variant codenamed Hodur, so named because of its resemblance to another variant called THOR.

The post Stabbed in the back: Chinese Mustang Panda Cyberspies Attack Russian Officials appeared first on Gridinsoft Blog.

UEFI attacks are the holy grail for hackers. After all, UEFI is loaded before the operating system and controls all processes at an “early start”. Hence the main danger associated with compromising this environment: if you make changes to the UEFI code, you can take complete control of the computer. For example, change memory or disk contents, or force the operating system to run a malicious file. Since we are talking about low-level malware, it will not work to get rid of it by replacing the hard drive or reinstalling the OS.

The first bootkit for UEFI, LoJax, was discovered by ESET in 2018. Then the researchers concluded that it was the work of the Russian-speaking “government” hack group Fancy Bear.

Since then, UEFI bootkits have been found more than once, and the last such case was described last week: Kaspersky Lab experts spoke about the tools of the Chinese cyber-espionage group GhostEmperor.

Now the list of UEFI bootkits has been replenished with one more item, the ESPecter malware. ESET experts say that the first attacks using this malware were discovered back in 2012. However, then ESPecter was not used as a bootkit for UEFI, its original purpose was to attack systems with BIOS. Only in 2020 did the malware authors update the code and switched to attacks on UEFI.

Researchers still do not know exactly how the attacks of these unknown attackers begin. It is unclear if they are gaining physical access to the target systems or whether they are using classic phishing to deploy ESPecter on the victim’s network.

However, once the installation process begins, the initial ESPecter components are known to modify the Windows Boot Manager and bypass the Windows Driver Signature Enforcement (DSE) to load and run an unsigned malicious driver – the actual payload of the ESPecter bootkit.

It is reported that hackers usually use ESPecter to deploy other malware and try to gain a foothold in the system in order to “survive” reinstallation of the OS. The malware detected in such attacks includes a backdoor Trojan that cybercriminals used to search for confidential files on the local system, periodically create screenshots and launch a keylogger.

ESET analysts point out that ESPecter is the second known UEFI bootkit that uses EFI System Partition (ESP) as its entry point. The first malware of this kind was a bootkit recently discovered by Kaspersky Lab, which is part of the FinSpy toolkit. The point is, other UEFI bootkits usually use UEFI SPI flash memory.

Let me remind you that we also told that The expert told how he hacked into a nuclear power plant.

The post Experts discovered ESPecter UEFI bootkit used for espionage appeared first on Gridinsoft Blog.