Organizations in Italy are the target of a new phishing campaign that leverages a new strain of malware called WikiLoader with an ultimate aim to install a banking trojan, stealer, and spyware referred to as Ursnif (aka Gozi).
“It is a sophisticated downloader with the objective of installing a second malware payload,” Proofpoint said in a technical report.
“The malware uses multiple mechanisms to evade detection and was likely developed as a malware that can be rented out to select cybercriminal threat actors.”
The enterprise security firm said it first detected the malware in the wild on December 27, 2022, in connection with an intrusion set mounted by a threat actor it tracks as TA544, which is also known as Bamboo Spider and Zeus Panda.
In a sign that WikiLoader is shared among multiple cybercrime groups, the threat actor dubbed TA551 (aka Shathak) has also been observed employing the malware as of late March 2023.
WikiLoader is heavily obfuscated and comes with evasive maneuvers to bypass endpoint security software and avoid detonation in automated analysis environments. It’s also engineered to retrieve and run a shellcode payload hosted on Discord, which is ultimately used to launch Ursnif.
“It is likely more criminal threat actors will use this, especially those known as initial access brokers (IABs) that conduct regular activity that leads to ransomware. Defenders should be aware of this new malware and activities involved in payload delivery, and take steps to protect their organizations against exploitation.”
Source: https://thehackernews.com/
