A new malware outbreak through Whatsapp in several countries

A new malware outbreak has been found through Whatsapp in several countries with a fake business document.

According to a report by the website Windows Report, a research team from Kaspersky, a well-known antivirus software developer, found a malware distribution campaign through the Whatsapp application, a phishing scam. Hackers are business or Trusted Contracts. After the victim responds, hackers claim to have financial documents such as financial reports, statements, and other business documents as attachments for the victim to open, but the file is actually a VBScript script file for opening the Windows operating system.

In the malware operation, after the victim runs the file, the script contacts the control server (C2 or Command and Control) to download the component element of the malware on the machine. After that, the second script modifies the Windows Registry to weaken the User Account Control (UAC) protection system. This leads to the next step: the script downloads a zip compressed file that contains a remote management tool called ManageEngine Endpoint Central. As usual, it's often a tool used by IT departments to take over to manage the maintenance of employees' machines in companies, but hackers have misused it to control the victim's machine instead in this case.

The research team conducted an in-depth investigation and found that the impersonation file was made in a variety of languages, making it expected that the campaign was not limited to a certain area, but was targeted as a global attack. The confirmed outbreak countries included Brazil, India, Mexico, Singapore, Taiwan, Spain, Australia, Russia, Vietnam, Malaysia, and the United Kingdom, which is called a huge variety. In addition, the research team also investigated the related infrastructure, found that it was mainly used in Chinese, and that it was used in combination with remote control type malware ( RAT or Remote Access Trojan), but it still can't confirm the real male behind it at the moment.

# Trending # lemon 8 diary # whatsapp # freedomhack # it