The creators of the More_eggs malware are expanding their activity through malware-as-a-service (MaaS) , linking it to the RevC2 backdoor and Venom Loader malware , distributed via VenomLNK.
RevC2 uses WebSockets to communicate with the Command and Control (C2) server and offers capabilities such as stealing cookies and passwords, managing network traffic via proxy, and executing remote commands.
Read more: MirrorFace: Installs ANEL and NOOPDOOR Backdoors
On the other hand, the Venom Loader is customized for each victim, encrypting the payload based on the target computer name.
According to Zscaler ThreatLabz, malicious campaigns exploiting these software were observed from August to October 2024 and are linked to the Venom Spider group (also known as Golden Chickens).
VenomLNK acts as the initial means of access, using PNG images as bait, while in the background it activates the malware. RevC2, in addition to data theft, can execute shell commands, take screenshots and operate under different user profiles. Venom Loader, on the other hand, implements a lighter version of More_eggs, focusing exclusively on remote command execution (RCE) capabilities.
See more: APT-C-60 hackers exploit StatCounter & Bitbucket to distribute SpyGlace backdoor
At the same time, ANY.RUN detected another malware, PSLoramyra, a fileless loader that uses PowerShell, VBS and BAT scripts to inject payloads directly into memory while maintaining access to the system. These developments demonstrate that malware creators continue to upgrade their tools, despite the arrests of two individuals associated with the MaaS platform last year.
Source: thehackernews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
