Call Centers Used to Distribute BazarLoader

Call Center Used Distribute BazarLoaderCybercriminals are using call centers to trick users into downloading the BazarLoader malware, according to researchers at Palo Alto Networks’ Unit 42. By relying on social engineering to convince users to install the malware themselves, the attackers don’t have to worry about malicious emails being blocked by security filters.

“In early February 2021, researchers began reporting a call center-based method of distributing BazarLoader,” Unit 42 says. “This method utilizes emails with a trial subscription-based theme that encourages potential victims to call a phone number. A call center operator then answers and directs victims to a website to unsubscribe from the service. Call center operators offer to personally guide victims through a process designed to infect vulnerable computers with BazarLoader.”

The emails inform users that their credit card will be charged unless they call the number in the email to cancel their subscription. During the ensuing conversation, the scammer convinces the user to download an Excel file that supposedly contains a confirmation code. When the user opens this file and enables macros, their computer will be infected with BazarLoader.

The researchers note that BazarLoader is then used to deploy additional, more damaging malware like Trojans or ransomware.

“BazarLoader provides backdoor access to an infected Windows host,” they write. “In some cases, Cobalt Strike is seen as follow-up malware, leading to other malware like Anchor. At least two cases have been publicly documented where BazarLoader malware led to Cobalt Strike and then to Anchor malware. One case happened in February 2021, and the other case happened in March 2021. However, BazarLoader is not limited to just Cobalt Strike and Anchor as follow-up malware. 2020 saw reports of BazarLoader leading to ransomware like Ryuk. Backdoor access to an infected Windows host could lead to any family of malware.”

New-school security awareness training can help your employees thwart phishing attacks by teaching them how to recognize social engineering tactics.

Palo Alto Networks’ Unit 42 has the story.

Free Ransomware Simulator Tool

Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RansIm-Monitor3Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 23 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews