CyberSecurity news
FlagThis
@www.recordedfuture.com
//
A new malware loader called MintsLoader is being used to distribute a remote access trojan (RAT) known as GhostWeaver. According to a report by Recorded Future's Insikt Group, MintsLoader employs a multi-stage infection chain that involves obfuscated JavaScript and PowerShell scripts. This loader is designed to evade sandbox environments and virtual machines, making it more difficult to detect and analyze. It also utilizes a domain generation algorithm (DGA) to create daily-changing command-and-control (C2) domains, adding another layer of complexity to the attack.
MintsLoader has been observed in phishing and drive-by download campaigns since early 2023. It is known to deliver various follow-on payloads, including StealC and a modified version of the Berkeley Open Infrastructure for Network Computing (BOINC) client. Threat actors are using MintsLoader in e-crime services like SocGholish and LandUpdate808, targeting the industrial, legal, and energy sectors through phishing emails and fake browser update prompts. Recent attacks have also incorporated the ClickFix social engineering tactic to trick users into executing malicious code.
GhostWeaver, the RAT distributed by MintsLoader, is designed to maintain persistent communication with its C2 server, which is secured through TLS encryption using an obfuscated, self-signed X.509 certificate. GhostWeaver can also deploy MintsLoader as an additional payload. The loader's primary strengths lie in its evasion techniques and DGA implementation, which allow it to bypass security measures and complicate detection efforts.
References :
MintsLoader has been observed in phishing and drive-by download campaigns since early 2023. It is known to deliver various follow-on payloads, including StealC and a modified version of the Berkeley Open Infrastructure for Network Computing (BOINC) client. Threat actors are using MintsLoader in e-crime services like SocGholish and LandUpdate808, targeting the industrial, legal, and energy sectors through phishing emails and fake browser update prompts. Recent attacks have also incorporated the ClickFix social engineering tactic to trick users into executing malicious code.
GhostWeaver, the RAT distributed by MintsLoader, is designed to maintain persistent communication with its C2 server, which is secured through TLS encryption using an obfuscated, self-signed X.509 certificate. GhostWeaver can also deploy MintsLoader as an additional payload. The loader's primary strengths lie in its evasion techniques and DGA implementation, which allow it to bypass security measures and complicate detection efforts.
Share:
References :
- The Hacker News: MintsLoader Drops GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks
- www.recordedfuture.com: MintsLoader Malware Leverages DGA and Anti-Analysis Techniques to Deploy GhostWeaver RAT and Other Payloads
Classification:
- HashTags: #malware #MintsLoader #GhostWeaver
- Company: Recorded Future, Microsoft
- Target: Industrial Sector
- Product: PowerShell
- Feature: multi-stage infection chain
- Malware: MintsLoader, GhostWeaver
- Type: Malware
- Severity: Major