Ande Loader malware targets the construction sector

The hacking group known as Blind Eagleuses a malware loader called Ande Loader to deliver Remote Access Trojans (RATs) such as Remcos RAT and NjRAT.

See also: Malicious Google ads trick Mac users into installing Atomic Stealer malware

The attacks, which take the form of email scams, focused on Spanish-speaking users in the construction industry and based in North America, eSentire said.

Blind Eagle (also known as APT-C-36) is a financially motivated threat actor with a history of conducting cyberattacks against entities in Colombia and Ecuador, with the aim of sending a variety of RATs, including AsyncRAT, BitRAT, Lime RAT, NjRAT, Remcos RAT, and Quasar RAT.

The latest findings signal a broadening of the attacker's attack scope, also using RAR and BZ2 file fraud to trigger the infection chain.

Password-encrypted RAR files contain a malicious Visual Basic Script (VBScript) that is responsible for creating persistence in the Windows and launching the Ande Loader malware, which in turn loads the Remcos RAT.

See also: “TicTacToe Droppers” are used to distribute malware

Other malware families

In an alternative attack chain observed by the Canadian cybersecurity firm, a BZ2 file containing another VBScript file is distributed via a Discord (CDN) link. The Ande Loader malware, in this case, instead of dropping the Remcos RAT, drops the NjRAT.

SonicWall has shed light on the operation of another family of loader malware called DBatLoader, analyzing the use of a legitimate but vulnerable driver program associated with software (truesight.sys) to terminate security programs as part of a Bring Your Own Vulnerable Driver (BYOVD) and ultimately to deliver the Remcos RAT.

“The Ande Loader malware is received within a file as an email and can be transformed, containing multiple layers of data encryption,” the company noted earlier this month.

See also: Malware families adapt to COM Hijacking technique

Tips for protecting against malware

One of the most effective ways to protect yourself from malware, such as Ande Loader, is to use reliable antivirus. This software is able to detect and remove malware before it can cause damage to your computer. It is also important to keep your operating system and all software up to date. Using the internet cautiously is another critical method of protection. Finally, using strong passwords and changing them regularly can help protect against malware threats. Malicious users often exploit weak passwords to break into systems and install malware.

Source: thehackernews