27 C
Jaipur
Friday, October 30, 2020

APT Group Uses Cross-platform Malware Framework to Launch Attack

Must read

How to Install YOURLS self-hosted URL shortener on CentOS 8

YOURLS is a free, open-source and self-hosted URL shortener written in PHP. It is very similar to TinyURL or Bitly and allows you to...

phishing: Cyberattacks hit over 1,000 schools, colleges between June and September: Report – Latest News

Spear phishing attacks hit the education sector hard between June and September, affecting more than 1,000 schools, colleges, and universities, according to a global...

Parliamentary panel questions Google, Paytm on data privacy, Chinese investment – Latest News

Google and digital payments major Paytm were questioned by a parliamentary panel in India on a range of issues including data privacy and China...

startups: MoUs to be inked with 25 startups for exchange of tech: IGCAR – Latest News

The Indira Gandhi Centre for Atomic Research (IGCAR) at Kalpakkam near here on Friday said it was aiming to sign memoranda of understanding (MOUs)...

Lazarus APT group believed to be run by the North Korean government, the group know to be active since 2009. The group is financially motivated and known for it’s broad & cross-platform targeting.

Researchers observed a new cross-platform malware framework used by the threat actor group to compromise various organizations in Europe and Asia recently.

MATA Malware Framework

The MATA malware framework used by threat actors from April 2018 to infiltrate corporate entities around the world.

The MATA framework consists of several frameworks the process several components such as the loader, orchestrator, and plugins.

The MATA found to be circulated in April 2018, according to Kaspersky’s research, the threat actors expanded their operations by crafting a brand-new malware framework.

The malware framework found to be used in several hacking campaigns, those target organizations operating in different sectors.

With the framework attackers able to target Windows, Linux, and macOS operating systems. Kaspersky found “several victims from our telemetry and figured out the purpose of this malware framework.”

By using MATA attackers can load additional malware, inject DLLs, manipulates files, and creates proxies on the affected network.

The Windows version of MATA is capable of loading 15 plugins at the same time and to covertly communicate with the C2 server hey employs TLS1.2 connections.

The MATA also allows hackers to scan for new targets on macOS and Linux-based machines, the plugin of Linux version and macOS version are identical.

According to Kaspersky telementary, the victims were recorded in the following countries such as Poland, Germany, Turkey, Korea, Japan, and India.

Once the attacker deployed MATA malware and its plugins, they attempted to find the victim’s databases and execute several database queries to acquire customer lists.

Kaspersky can assess that the MATA framework is linked to the Lazarus APT group. The MATA orchestrator uses two unique filenames, c_2910.cls and k_3872.cls, which have only previously been seen in several Manuscrypt variants, including the samples (0137f688436c468d43b3e50878ec1a1f) mentioned in the US-CERT publication.

The hacker group behind this advanced malware framework attack aimed to steal the customer’s database and distribute ransomware.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

How to Install YOURLS self-hosted URL shortener on CentOS 8

YOURLS is a free, open-source and self-hosted URL shortener written in PHP. It is very similar to TinyURL or Bitly and allows you to...

phishing: Cyberattacks hit over 1,000 schools, colleges between June and September: Report – Latest News

Spear phishing attacks hit the education sector hard between June and September, affecting more than 1,000 schools, colleges, and universities, according to a global...

Parliamentary panel questions Google, Paytm on data privacy, Chinese investment – Latest News

Google and digital payments major Paytm were questioned by a parliamentary panel in India on a range of issues including data privacy and China...

startups: MoUs to be inked with 25 startups for exchange of tech: IGCAR – Latest News

The Indira Gandhi Centre for Atomic Research (IGCAR) at Kalpakkam near here on Friday said it was aiming to sign memoranda of understanding (MOUs)...

Display Network Information In Linux Using What IP Tool

What IP is a simple graphical application used to display network information in Linux operating systems. Using What IP, anyone can easily find the...