A new variant of the LodaRAT malware is targeting Windows users around the world, with the aim of stealing sensitive information.
Cybersecurity researchers at Rapid7 have discovered the latest version of the RAT malware, which has enhanced capabilities (e.g., the ability to steal cookies and passwords from popular browsers like Microsoft Edge and Brave).
The malware now has a wide range of functions to extract data, deliver additional malware, take screenshots, and control the victim's camera and mouse.
Unlike previous versions that relied on phishing emails and exploits, the new LodaRAT samples are distributed via DonutLoader and CobaltStrike, two well-known malware delivery tools.
See also: Russian hackers exploit NTLM vulnerability to spread RAT Malware via Phishing emails
Additionally, the new LodaRAT has been found on systems infected with other malware such as AsyncRAT, Remcos, and Xworm, although the exact relationship between these infections remains unclear.
The researchers also noted that the current attacks are targeting users worldwide, while previous attacks targeted specific countries or organizations. The broader targeting may indicate either a change in the attackers' goals or a wider use of the LodaRAT codebase by different groups.
How does LodaRAT malware work?
During execution, LodaRAT uses various techniques to establish persistence on infected systems (adding entries to the Windows registry run key, creating scheduled tasks to execute the malware, impersonating legitimate software).
The malware performs an initial reconnaissance on the infected system, collects information (e.g. operating system version, user rights, virus protection and hardware details) and sends it to an attacker's C2 server.
See also: New phishing campaign distributes fileless variant of Remcos RAT
The key features of the new version of LodaRAT malware are:
- Downloading and executing additional payloads
- Remote command execution
- Mouse and keyboard control
- Taking screenshots
- Webcam access and Microphone audio recording
- Theft of credentials and cookies
- Handling Windows Firewall
- File theft
- Create a local user account
Protection against RAT malware
The first and most important way to protect against RAT malware is to install reliable security software. This software should include protection against viruses, spyware, malware, and other attacks, as well as the ability to detect and remove RATs (e.g. LodaRAT).
Additionally, it is important to keep your operating system and all your applications up to date. These updates often include security that can protect your computer from the latest known RAT malware.
See also: Pakistani hackers APT36 target India with ElizaRAT
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
You should also be careful with emails and messages you receive. Many RAT malware are spread through phishing attacks, so avoid opening attachments or clicking links from unknown sources.
Using strong passwords and changing them regularly can also help protect against attacks (e.g. LodaRAT). Also, using two-factor authentication can add an extra layer of security.
Finally, information security training can be particularly useful. Understanding the ways in which RAT malware invades system and how to protect against them can help you stay safe.
Source: cybersecuritynews.com
