Hackers use open source Microsoft dev platform to deliver trojans
Microsoft's Build Engine is being used to deploy Remcos password-stealing malware
Security researchers at Anomali Threat Research observed a new campaign whereby threat actors used Microsoft Build Engine (MSBuild) to filelessly deliver the Remcos remote access tool (RAT) and password-stealing malware commonly known as RedLine Stealer.
Researchers said the campaign appeared to have begun in April this year and was ongoing. Hackers used MSBuild — a tool used for building apps and gives users an XML schema “that controls how the build platform processes and builds software” — to deliver RemcosRAT and RedLine stealer using callbacks.
The files delivered contained encoded executables and shellcode — some were hosted on Russian image-hosting site, “joxi[.]net.” While researchers couldn’t determine the distribution method of the .proj files, these files’ objective was to execute either Remcos or RedLine Stealer. Most of the malware analyzed delivered Remcos as the final payload.
Once installed on the victim’s computer, the Remcos trojan allows hackers to remote control, remote admin, remote anti-theft, remote support, and pentest a machine.
How to increase cyber resilience within your organisation
Cyber resilience for dummiesDownload now
While Remcos is commercial software created by Breaking Security, hackers often use it for malicious purposes. Researchers said the software enables full access to the infected machine with features like anti-AV, credential harvesting, gathering system information, keylogging, persistence, screen capture, script execution, and more.
The other malware observed in the campaign is Redline Stealer. This malware is written in .Net and when installed on a victim’s system, it can steal multiple types of data, such as cookies, credentials, crypto wallets, NordVPN credentials, stored web browser information, and system information. It will also search for multiple products, including cryptocurrency software, messaging apps, VPNs, and web browsers.
Using MSBuild allows hackers to evade detection while installing malicious payloads directly to a targeted computer's memory.
"The threat actors behind this campaign used fileless delivery as a way to bypass security measures, and this technique is used by actors for a variety of objectives and motivations," said researchers.
"This campaign highlights that reliance on antivirus software alone is insufficient for cyber defense, and the use of legitimate code to hide malware from antivirus technology is effective and growing exponentially."
How virtual desktop infrastructure enables digital transformation
Challenges and benefits of VDIFree download
The Okta digital trust index
Exploring the human edge of trustFree download
Optimising workload placement in your hybrid cloud
Deliver increased IT agility with the cloudFree Download
Modernise endpoint protection and leave your legacy challenges behind
The risk of keeping your legacy endpoint security toolsDownload now