Ars Technica used in malware campaign with never-before-seen obfuscation — Buried in URL was a string of characters that appeared to be random, but were actually a payload::Vimeo also used by legitimate user who posted booby-trapped content.
Ars Technica used in malware campaign with never-before-seen obfuscation — Buried in URL was a string of characters that appeared to be random, but were actually a payload::Vimeo also used by legitimate user who posted booby-trapped content.
This is the best summary I could come up with:
Ars Technica was recently used to serve second-stage malware in a campaign that used a never-before-seen attack chain to cleverly cover its tracks, researchers from security firm Mandiant reported Tuesday.
A benign image of a pizza was uploaded to a third-party website and was then linked with a URL pasted into the “about” page of a registered Ars user.
The campaign came from a threat actor Mandiant tracks as UNC4990, which has been active since at least 2020 and bears the hallmarks of being motivated by financial gain.
Opening the same file in a hex editor—a tool for analyzing and forensically investigating binary files—showed that a combination of tabs, spaces, and new lines were arranged in a way that encoded executable code.
The base 64 strings in the image URL or video description, in turn, caused the malware to contact a site hosting the second stage.
Anyone who is concerned they may have been infected by any of the malware covered by Mandiant can check the indicators of compromise section in Tuesday’s post.
The original article contains 675 words, the summary contains 173 words. Saved 74%. I’m a bot and I’m open source!