Skip to main content

Criminals hijack antivirus software to deliver malware

A known Chinese threat actor has been found abusing a flaw in a well-known antivirus program to deliver malware to high-profile targets in Japan.

Cybersecurity researchers at Kaspersky recently spotted Cicada, also known as APT10,  tricking employees at various organizations in Japan - from media firms to government agencies - into downloading a compromised version of the company’s K7Security Suite.   

Those that fall for the trick end up getting LODEINFO, a three-year-old malware that’s capable of executing PE files and shellcode, uploading and downloading files, killing processes, and sending out file lists, among other things.

DLL sideloading

The malware is being distributed through a practice known as DLL sideloading. First, the victim needs to be led to a fake K7Security Suite download page, where they’d download the software. The installation executable itself wouldn’t be malicious - it would be the actual antivirus solution. However, the same folder would also carry a malicious DLL named K7SysMn1.dll. 

During regular installation, the executable will look for a file named K7SysMn1.dll, which is usually not malicious. If it finds it in the same folder where it sits, it won’t look any further and will run that file, instead. 

The threat actors would then create a malicious file, containing the LODEINFO malware, and give it the K7SysMn1.dll filename. In other words, it’s the antivirus program that ends up loading the malware onto the target endpoint. And given that a legitimate security application loads it, other security software might not detect it as malicious. 

The researchers were not able to determine how many organizations fell prey to this attack, or what the end goal of the campaign is. Given who the targets are, cyber espionage is the most obvious answer, though.

Side-loading .DLL files is no novel approach. In August 2022, it was reported that Windows Defender was abused to side-load LockBit 3.0, an infamous ransomware variant. 

Via: BleepingComputer



Source: TechRadar

Popular posts from this blog

The Best Early Black Friday iPhone Deals

We've begun tracking early Black Friday deals for major Apple products like AirPods , and now we're focusing on iPhone. Specifically, in this guide we'll share the best early Black Friday deals on iPhone 15, iPhone 15 Plus, iPhone 15 Pro, iPhone 15 Pro Max, and more. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Of course, there is a chance that we could see better deals on iPhone arrive as Black Friday gets closer. This is a risk anyone has to take while shopping during the holidays, so with that in mind, many of the deals shared below are currently their best prices ever seen. More information on these sales can be found in our Black Friday Roundup . Best iPhone and Accessory Deals iPhone 15 Pro/Pro Max for up to $1,000 off at AT&T iPhone 15 Pro with free Apple TV 4K and Apple One six month subscription at Verizon AirTag

iPhone 13 Pro vs. iPhone 15 Pro Buyer's Guide: 50+ Differences Compared

The iPhone 15 Pro brings over 50 new features and improvements to Apple's high-end smartphones compared to the iPhone 13 Pro, which was released two years prior. This buyer's guide breaks down every major difference you should be aware of between the two generations and helps you to decide whether it's worth upgrading. The ‌iPhone 13‌ Pro debuted in 2021, introducing a brighter display with ProMotion technology for refresh rates up to 120Hz, the A15 Bionic chip, a telephoto camera with 3x optical zoom, Macro photography and photographic styles, Cinematic mode for recording videos with shallow depth of field, ProRes video recording, a 1TB storage option, and five hours of additional battery life. The ‌iPhone 13‌ Pro was discontinued upon the announcement of the iPhone 14 Pro in 2022, but it is still possible to get hold of it second-hand. Our guide helps to answer the question of how to decide which of these two iPhone models is best for you and serves as a way to c

GiliSoft File Lock 3.4

A new program to encrypt and hide to protect files and folders and disks and make it safer. download : http://www.gilisoft.com/download/FileLockPro42.exe

Best Cyber Monday Apple Accessory Deals Available Today

Yesterday we shared a huge list of deals on Apple products for Cyber Monday , and now we're shifting our focus to accessory sales from popular third-party retailers. This includes discounts from Sonos, Twelve South, Nomad, Satechi, and many more. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Many Cyber Monday deals are known to sell out fast, so keep that in mind when browsing our posts and shopping online today. If you see something you're interested in, be sure to snag it quickly. You can also check out Cyber Monday deals on Apple products in our individual posts listed below. The Best Cyber Monday Apple Deals The Best Cyber Monday AirPods Deals The Best Cyber Monday iPhone Deals The Best Cyber Monday iPad Deals The Best Cyber Monday HomePod Deals The Best Cyber Monday Apple Watch Deals The Best Cyber Monday MacBook Deals