Cybersecurity researchers have spotted yet another fake job campaign distributing deadly malware.
Mandiant’s latest report (opens in new tab) found that a new version of known malware (opens in new tab) threat Ursnif (also known as Gozi) has been reported in the wild.
Unlike the previous versions, this one does not carry its usual banking trojan functionalities, prompting researchers to speculate the malware is being modded to distribute ransomware.
Fake job offers on LinkedIn
Mandiant dubbed this version LDR4, after spotting it in late June 2022. To distribute the malware, the threat actors are creating fake LinkedIn accounts, posing to be recruiters for major companies. After reaching out to their targets and engaging in a conversation to establish some legitimacy, they share a link.
The linked website then demands victims solve a CAPTCHA challenge to download an Excel document that claims to offer more details about the position, but actually carries a malicious macro that fetches the malware from a remote location.
As LDR4 comes in the form of a .DLL file (loader.dll), is packed by portable executable crypters, and is signed with valid certificates, it evades detection from some antivirus (opens in new tab) solutions, the researchers warned.
Once the .DLL file runs, it collects system service data from the Windows registry and generates a user and system ID. It also connects to the malware’s command and control server (C2) to obtain the list of commands it needs to execute.
Currently, the researchers can’t 100% confirm Ursnif’s endgame, but they did note that a threat actor was allegedly observed asking for partners to distribute ransomware and the RM3 version of Ursnif via underground hacking forums.
The last time we heard of Ursnif was in January 2022, when HP Wolf Security observed it being distributed, via weaponized Excel files, among Italian-speaking users.
Via: BleepingComputer (opens in new tab)
