Microsoft have recently shared details of a new threat in the wild aiming to steal users’ data. Dubbed RevengeRAT or AsyncRAT, the malware currently spreads via spear phishing emails, for which, Microsoft warns users to stay cautious.
Microsoft Warns Of RevengeRAT Active In The Wild
Recently, the Microsoft Security Intelligence team has shared insights about a new security threat in the wild. Specifically, Microsoft warns of a loader malware that targets users with the notorious RevengeRAT.
As revealed, the malware, under distribution via spearphishing emails, typically aims at the aerospace and travel sectors. The phishing emails usually mimic messages about cargo contracts and other related stuff that people from the said industries would likely consider to open.
Like always, these emails often include attachments that, upon clicking, deliver the malware. But, specifically, the malicious executable in this campaign is actually a ‘loader’.
The security firm Morphisec has identified this loader as Snip 3 Cryptor. It exhibits evasive techniques to bypass detections. This loader, upon reaching the target device, then delivers a remote access trojan. The trojan lets the attackers gain access to the infected device. Explaining how Snip3 does that, Morphisec stated in the blog post,
The Crypter is most commonly delivered through phishing emails, which lead to the download of a visual basic file. In some cases, however, the attack chain starts with a large install file, such as an Adobe installer, which bundles the next stage.
Microsoft has identified this trojan as RevengeRAT or AsyncRAT. Regarding its functionality, Microsoft explained in its tweet,
Attackers use the remote access Trojans for data theft, follow-on activity, and additional payloads, including Agent Tesla, which they use for data exfiltration.
The type of data the attackers may steal include credentials, webcam data, screenshots, browser data, clipboard, system and network information. Whereas, the attackers use SMTP Port 587 to exfiltrate this data.
Stay Wary Of Phishing Emails
Like always, avoiding opening unsolicited emails is the key to protect oneself from falling a victim to such campaigns.
Nonetheless, to facilitate organizations, Microsoft has also published advanced hunting queries.
If your org is in the targeted sectors, we recommend validating that you’re not affected. We published advanced hunting queries that you can use to locate relevant or similar activities, emails, implants, and other indicators of attack in your environment: https://t.co/fTzolaTvfq
— Microsoft Security Intelligence (@MsftSecIntel) May 11, 2021
Let us know your thoughts in the comments.