🚨Malware Hides in PNGs, Drops Reverse Tunnel on Victims
Malware hides in PNGs, drops reverse tunnel on victims
TL;DR
A new malware attack hides payloads in PNG images and establishes a reverse tunnel on victims' machines. It uses steganography and exploits legitimate Windows executables to maintain persistence.
A new malware attack chain hides payloads in PNG images and establishes a reverse tunnel on victims' machines. The attack begins with a phony Cloudflare CAPTCHA overlay, tricking users into downloading a ZIP archive from an attacker-controlled server. This archive contains a batch file that executes a legitimate, signed Windows executable, LockScreenContentServer.exe, which acts as a host for the malicious payload. The malware then uses steganography to hide additional payloads inside PNG images, establishing persistence through registry keys and scheduled tasks. This attack is particularly concerning for developers and IT teams managing Windows environments, as it exploits legitimate tools and can bypass traditional security measures. The attack chain demonstrates sophisticated techniques for maintaining persistence and establishing a reverse WebSocket tunnel for network-level proxy access.
Key Points
Attack begins with a phony Cloudflare CAPTCHA overlay, tricking users into downloading a ZIP archive from an attacker-controlled server.
ZIP archive contains a batch file (1.bat) that executes a legitimate, signed Windows executable, LockScreenContentServer.exe.
Malware uses steganography to hide additional payloads inside PNG images, establishing persistence through registry keys and scheduled tasks.
Attack deploys a custom, Python-based reverse-tunnel implant that sets up a reverse WebSocket tunnel for network-level proxy access.
Attack can be avoided by restricting PowerShell and Run dialog execution, blocking or auditing the Windows Run dialog, and training employees.
Why It Matters
This attack chain is a significant threat to Windows environments, exploiting legitimate tools and bypassing traditional security measures. IT teams managing Windows environments should restrict PowerShell and Run dialog execution, block or audit the Windows Run dialog, and train employees to recognize such tactics. The use of steganography and reverse tunnels highlights the evolving nature of malware and the need for advanced security measures.
Frequently Asked Questions
Why does this matter?
This attack chain is a significant threat to Windows environments, exploiting legitimate tools and bypassing traditional security measures. IT teams managing Windows environments should restrict PowerShell and Run dialog execution, block or audit the Windows Run dialog, and train employees to recognize such tactics. The use of steganography and reverse tunnels highlights the evolving nature of malware and the need for advanced security measures.
What happened?
A new malware attack hides payloads in PNG images and establishes a reverse tunnel on victims' machines. It uses steganography and exploits legitimate Windows executables to maintain persistence.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,416 builders reading daily.