In 2019, Valak Malware was first observed as a malware loader. However, recently it became known that software can also be used for data theft. Specifically, researchers discovered a new Valak Malware campaign, which targets the US and Germany.
According to Cybereason, the new Valak Malware spreads using a Word file that contains a piece of malicious code. The same file exists in English, but also in German depending on the origin of the users it targets.
Then, the code included in the file is executed, which downloads additional malware tools. In the first stage, the attack is fileless. In the next phase, the malware starts collecting various data, such as: user data, device data, as well as the location of the device. During data, the malware creates and saves some screenshots, while also downloading some other plugins and malware, such as UrSnif and IcedLD, which are used in subsequent attacks.
While it was originally built as a malware loader, today, Valak Malware is a very powerful data theft tool. The latest version of the software proves this, as many more tools have been added to it, which make the software easier to use.
The malware mainly targets administrators and corporate networks. The researchers also report that although it collects a lot of data, the malware's main target is data from the Microsoft Exchange system (e.g. user details, as well as domain information ).
Researchers observed that the malware has the same infrastructure across all its variants.
Keeping in mind that the Ursnif and IcedID malware originated in Russia, the researchers conclude that Valak may also be a Russian attack.
Valak Malware, with its sophisticated properties, can be used alone to carry out attacks but also in combination with other malware.
