Malware Alert: FakeBat Exploits High-Traffic Software Search Queries

 

Rising Threat: FakeBat Malware Exploits Popular Software Searches

Cybersecurity researchers have recently uncovered a surge in malware infections caused by sophisticated malvertising campaigns distributing a dangerous loader known as FakeBat. This malicious software preys on users searching for popular business applications, leading to significant cybersecurity risks.

What Is FakeBat Malware?

FakeBat, also known as EugenLoader or PaykLoader, is a type of Malware-as-a-Service (MaaS) that’s currently being tracked by the Google-owned threat intelligence team under the name NUMOZYLOD. This malware is associated with the threat actor group Eugenfest, and its distribution has been attributed to the cybercriminal group UNC4536.

How FakeBat Spreads: Malvertising and Drive-By Downloads

FakeBat leverages drive-by download techniques to exploit users seeking popular software. Cybercriminals use malvertising to redirect users to fake websites mimicking legitimate software distribution sites. These deceptive sites host trojanized MSI installers that, when downloaded and executed, deploy FakeBat onto the victim’s system.

The types of malware delivered through FakeBat include:

• IcedID: A banking Trojan that steals financial information.
• RedLine Stealer: A credential-stealing malware.
• Lumma Stealer: Another data-stealing threat.
• SectopRAT (ArechClient2): A remote access Trojan (RAT) used for spying.
• Carbanak: A sophisticated malware used by the FIN7 cybercrime group for large-scale financial theft.

UNC4536's Deceptive Techniques

The UNC4536 group’s attacks involve distributing trojanized MSIX installers disguised as popular applications like Brave, KeePass, Notion, Steam, and Zoom. These installers are crafted to execute a script before launching the main application, a process known as startScript.

This approach allows FakeBat to act as a delivery vehicle for additional payloads from various threat actors, including the notorious FIN7 group. NUMOZYLOD, the variant of FakeBat, collects extensive system information, including operating system details, domain information, and antivirus software data. Some versions also gather the host’s public IPv4 and IPv6 addresses and create persistent shortcuts in the StartUp folder.

Recent Developments and Security Measures

This discovery comes shortly after Mandiant reported on EMPTYSPACE (also known as BrokerLoader or Vetta Loader), another malware downloader used by the financially motivated threat cluster UNC4990. EMPTYSPACE has been linked to data exfiltration and cryptojacking attacks targeting Italian organizations.

To protect against FakeBat and similar threats, users should:

• Download Software from Trusted Sources: Ensure you are obtaining applications from official and reputable websites.
• Use Robust Security Software: Employ up-to-date antivirus and anti-malware solutions.
• Keep Software Updated: Regularly update your operating system and applications to patch vulnerabilities.
• Be Cautious with Links and Downloads: Avoid clicking on suspicious links or downloading files from unknown sources.

As cybercriminals continue to refine their tactics, staying informed and implementing strong cybersecurity practices is crucial for safeguarding your digital assets.

https://www.cypro.se