Hackers use Yokai Malware

Hackers have targeted individuals connected to the Thai government using a new malware called “Yokai.”

This is a simple but dangerous backdoor, which allows hackers to execute system commands and steal data.

See also: Hackers exploit Google Search ads to spread Malvertising

Netskope researchers discovered two shortcut (LNK) files, disguised as .pdf and .docx files, that appeared to be related to official business between the US government and Thailand. The files contained bait with references to criminal collaborations, specifically targeting Thai police.

Hackers exploited the Windows “esentutl” command to write malicious data to alternate data streams (ADS) on the NTFS file system. This technique allowed the malicious elements to be hidden in seemingly harmless files, making them harder to detect by basic security tools.

Read also: Hackers use fake video conferencing apps to distribute Realst Malware

Once Yokai infects a system, it initiates communication with the command and control (C2) server, creating an encrypted channel for future communications. Despite some elements of sophistication, such as C2 communication, Yokai proves to be amateurish in certain areas.

For example, it creates endless repetitions of itself, causing noticeable system slowdowns and making it easier to detect by security tools (EDR).

See more: Malware detected using BYOVD technique

Researchers believe that Yokai is still in development, with potential improvements in future versions. The contrast between sophisticated features and amateurish weaknesses suggests the involvement of different individuals or groups in its creation.

Source: darkreading