Cybersecurity researchers have identified a new phishingthat exploits a fake Bitdefender antivirus websiteto distribute the Venom RAT – a powerful remote access trojan.
According to a report by DomainTools Intelligence (DTI), the deceptive website “bitdefender-download[.]com” lures visitors to software antivirus for Windows. The “Download for Windows” button triggers a download of a file from a repository on Bitbucket, which in turn redirects to an Amazon S3 bucket. Although the Bitbucket account has been disabled, the fingerprint of the attack remains clear.
See also: Google Ads spread malware via fake Homebrew Site
The downloaded file, named “BitDefender.zip”, contains an executable file (“StoreInstaller.exe”) that contains malware configurations related to the Venom RAT, as well as elements from the SilentTrinity and StormKitty — known frameworks for later exploitation and information theft.
Venom RAT, a variant of Quasar RAT, allows cybercriminals to gain permanent remote access to target systems, while collecting data, credentials, and information from crypto wallets.
According to DomainTools analysts, however, the malicious campaign relies on the coordinated action of all three tools mentioned above. The Venom RAT takes on the task of silently infiltrating target systems, while StormKitty focuses on stealing credentials and sensitive information from crypto wallets. Meanwhile, SilentTrinity offers attackers the ability to remain in the compromised environment undetected.
See also: Operation Endgame 2.0: Authorities “hit” malware businesses
The DTI reports that the malicious infrastructure of the fake Bitdefender site bears significant similarities to previous phishing campaigns that imitated banks and IT services, with the aim of stealing credentials from customers of Royal Bank of Canada and Microsoft.
Protection against RAT malware
The first and most important way to protect against RAT malware is to install reliable security software. This software should include protection against viruses, spyware, malware, and other attacks, as well as the ability to detect and remove RATs.
Additionally, it is important to keep your operating system and all your applications up to date. These updates often include security that can protect computer from the latest known trojans (e.g. Venom RAT).
See also: Fake installers for LetsVPN & QQ Browser distribute Winos 4.0 malware
You should also be careful with emails and messages you receive. Many RAT malware are spread through phishing attacks, so avoid opening attachments or clicking links from unknown sources.
Using strong passwords and changing them regularly can also help protect against attacks (e.g. Venom). Also, using two-factor authentication can add an extra layer of security.
Finally, information security training can be particularly useful. Understanding the ways in which RAT malware invades system and how to protect against them can help you stay safe.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: thehackernews.com
