Security Affairs Malware Newsletter Round 44

The latest edition of the Security Affairs Malware newsletter is here, bringing you the most recent and in-depth articles and research on malware in the international landscape. In this issue, we'll delve into some fascinating topics, including a rootkit variant of Is Back, an anti-malware plugin masquerading as legitimate, and Gmail's role as a command-and-control (C2) mechanism.

Is Back Returns as a Rootkit: StealC You

Malware enthusiasts have long been tracking the evolution of Is Back, a notorious rootkit that has been around since 2013. In recent times, researchers have observed an interesting twist on this classic malware - it's now masquerading as StealC, another well-known malware family. This new variant highlights the rapid changes and adaptations in the malware landscape.

Tracking the Rapid Changes: To StealC

The emergence of Is Back/StealC marks a concerning trend in the ever-evolving world of malware. Researchers are working tirelessly to keep pace with these threats, providing valuable insights into their behavior and tactics. As our understanding of malware grows, so does the importance of staying informed about emerging threats.

Interesting WordPress Malware Disguised as Legitimate Anti-Malware Plugin

In a fascinating example of malware masquerading as legitimate software, researchers have discovered a WordPress plugin that appears to be an anti-malware solution. However, this 'anti-malware' plugin is actually a Trojan horse, designed to install additional malicious software on the victim's system.

Using Trusted Protocols Against You: Gmail as a C2 Mechanism

Gmail has long been recognized as a popular email service used by individuals and organizations alike. However, in recent times, researchers have observed its use as a command-and-control (C2) mechanism for malware communication. This highlights the importance of cybersecurity awareness and the need to stay vigilant against potential threats.

Semantic-Aware Contrastive Fine-Tuning: Boosting Multimodal Malware Classification with Discriminative Embeddings

Researchers have made significant strides in developing more sophisticated methods for detecting malware. One such approach involves semantic-aware contrastive fine-tuning, which leverages discriminative embeddings to enhance multimodal malware classification.

The Rapid Evolution of CLEARFAKE Delivery Uncovering MintsLoader

Malware delivery systems are constantly evolving, and researchers continue to uncover new techniques used by attackers. In the case of CLEARFAKE, a relatively unknown malware campaign has been observed using a novel delivery mechanism involving a legitimate online forum.

MintsLoader: Uncovering a New APT Campaign

A recent discovery highlights the emergence of MintsLoader, an Advanced Persistent Threat (APT) campaign targeting Southeast Asian government and telecom sectors. Researchers are working diligently to understand the motivations behind this campaign and its potential implications.

Earth Kurma: APT Campaign with Sophisticated Evasion Techniques

A new APT campaign, dubbed Earth Kurma, has been identified using sophisticated evasion techniques to avoid detection by traditional security tools. Researchers are examining the tactics employed by these attackers to better understand their methods.

Inside the Latest Espionage Campaign of Nebulous Mantis DarkWatchman

Nebulous Mantis, a relatively unknown threat actor, has been linked to an espionage campaign targeting Southeast Asian government and telecom sectors. Researchers are analyzing the tactics and techniques used by this group to better understand their objectives.

MAL-XSEL: Enhancing Industrial Web Malware Detection with an Explainable Stacking Ensemble Model

Researchers have developed a novel approach to enhancing industrial web malware detection, leveraging an explainable stacking ensemble model. This innovative method provides valuable insights into the behavior of malware and can aid in the development of more effective security solutions.

Stay Informed with Security Affairs

For the latest news on cybersecurity threats, follow us on Twitter @securityaffairs, Facebook, and Mastodon. Our team of experts is dedicated to providing you with timely and informative content to help you stay one step ahead in the ever-evolving world of cyber threats.

Don't forget to share this newsletter with your colleagues and networks, helping to spread awareness about the latest malware developments and security best practices.