Cybercriminals have been found abusing the favored VLC multimedia participant to ship Cobalt Strike beacons to targets in Australia. 

The marketing campaign contains search engine marketing poisoning and the Gootkit loader malware (opens in new tab) and targets victims looking for healthcare establishments in Australia.

The malware was discoverd by Development Micro, with described how the menace actors created a malicious web site, designed to appear to be a discussion board, the place a consumer shared a healthcare-related settlement doc template inside a ZIP archive, in response to a question. 

“Poisoning” search engine outcomes pages

Then, as a way to get the web site to rank excessive on Google, they “poisoned” the search engine outcomes pages by including the hyperlink to the malicious website to as many articles and social media posts on-line, as potential. 

At any time when an internet site is closely linked to, Google’s algorithm perceives it as authoritative and pushes it increased on its outcomes pages. On this marketing campaign, the researchers discovered the malicious web site rating extremely for medical-related key phrases similar to “hospital”, “well being”, “medical”, and “settlement” – paired with the names of cities in Australia.

Victims that fall for the trick and obtain the malicious ZIP archive onto their endpoints would truly get Gootkit loader parts which later drop a PowerShell script that downloads extra malware onto the goal machine. Among the many recordsdata the loader grabs is a professional, signed copy of the VLC media participant and a malicious DLL file that, when triggered, deploys the Cobalt Strike beacon.

The VLC media participant file is proven because the Microsoft Distributed Transaction Coordinator (MSDTC) service. If the consumer runs it, VLC will search for the DLL file and run it, infecting the machine in what’s generally called a side-loading assault. 

Cobalt Strike is a business pentesting device permitting the consumer to deploy an agent named ‘Beacon’ on the sufferer machine. Cybercriminals use it to scan the goal community, transfer laterally, steal passwords and different delicate knowledge, and deploy extra devastating malware. Cobalt Strike beacons are sometimes adopted up with a ransomware assault. 

• This are the most effective antivirus (opens in new tab) options proper now

Through: BleepingComputer (opens in new tab)