Researchers at Fortinet are tracking a phishing campaign that’s distributing a new version of the VCURMS remote access Trojan (RAT).
“Recently, FortiGuard Labs uncovered a phishing campaign that entices users to download a malicious Java downloader with the intention of spreading new VCURMS and STRRAT remote access trojans (RAT),” the researchers write.
“The attackers stored malware on public services like Amazon Web Services (AWS) and GitHub, employing a commercial protector to avoid detection of the malware. The attacker attempts to use email as its command and control throughout the attack campaign. The receiving endpoint utilizes Proton Mail, which offers email services that include privacy protection.”
The malware is delivered via phishing emails that appear to contain payment-related information.
“It targets staff members, implying that a payment is underway and encourages them to click a button to verify payment information,” Fortinet says. “Upon clicking the button, a harmful JAR file hosted on AWS is downloaded to the victim's computer....The downloaded files resemble typical phishing attachments with spoofed names intended to lure people into opening them.
The malicious attachments will install a new strain of the VCURMS RAT that can exfiltrate account information, including “cookies, autofill data, browsing history, and passwords from browsers.”
“This comprehensive attack operation deploys several malicious programs simultaneously on a victim’s system,” the researchers write.
“It deploys a well-known STRRAT and a new VCURMS based on Java. Even though the VCURMS RAT primarily handles command and control communication, it also includes a modified version of a Rude Stealer and a keylogger in its second phase to gather sensitive data from the victim's system. We discovered that the threat actor was using multiple obfuscation techniques to avoid detection and attempting to use email for communicating with the command and control server.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Fortinet has the story.
