FlagThis

Cybersecurity analysts have uncovered a sophisticated campaign exploiting a fake Zoom installer to deliver BlackSuit ransomware across Windows-based systems. The attack, beginning with a malicious download from a website mimicking the teleconferencing application Zoom, lures unsuspecting victims into installing malware capable of crippling entire networks. When the victim clicked the “Download” button, they unknowingly triggered a chain reaction of events.

The fake installer, crafted with Inno Setup, hides the d3f@ckloader, a Pascal-based loader. After gaining initial access, the attackers deploy Brute Ratel and Cobalt Strike for lateral movement, using QDoor to facilitate RDP access. After 9 days, they deploy the BlackSuit ransomware across the network, deleting Volume Shadow Copies to hinder data recovery efforts before encrypting files and dropping ransom notes. The attackers also used WinRAR to compress file share data and uploaded the archives to Bublup, a cloud storage service for data exfiltration.

ImgSrc: securityonline.

References :

• bsky.app: The notorious North Korean Lazarus hacking group has reportedly adopted 'ClickFix' tactics to deploy malware targeting job seekers in the cryptocurrency industry, particularly centralized finance (CeFi).
• BleepingComputer: North Korean hackers adopt ClickFix attacks to target crypto firms
• Cyber Security News: Hackers Exploit Zoom Installer to Gain RDP Access and Launch BlackSuit Ransomware Attack
• gbhackers.com: Beware! A Fake Zoom Installer Drops BlackSuit Ransomware on Your Windows Systems
• Virus Bulletin: The DFIR Report researchers look into a fake Zoom installer that used d3f@ckloader & IDAT loader to drop SectopRAT, which dropped Cobalt Strike & Brute Ratel after 9 days. For later movement the threat actor used QDoor & finally deployed BlackSuit ransomware.
• Osint10x: Fake Zoom Ends in BlackSuit Ransomware
• securityonline.info: Fake Zoom, Real Ransom: Nine-Day Malware Intrusion Ends with BlackSuit Ransomware Blast
• bsky.app: Lazarus adopts ClickFix technique.
• : New “ClickFake Interview†campaign attributed to the Lazarus Group targets crypto professionals with fake job offers
• BleepingComputer: Report of the Lazarus Group adopting the ClickFix technique for malware deployment.

Classification:

• HashTags: #Ransomware #BlackSuit #Malware
• Company: Multiple
• Target: Windows users
• Product: Zoom
• Feature: Fake Zoom installer
• Malware: BlackSuit Ransomware
• Type: Ransomware
• Severity: Disaster