Researchers have uncovered a new malware campaign which they dub the “Hornets Nest”. What makes this attack notable is the deployment of six different malware variants in one go. These include cryptominers, infostealers, cryptostealer, and a backdoor.
Researchers from Deep Instinct have discovered a new malware attack that might be a threat designed especially for enterprises. As elaborated in their blog post, the campaign dubbed as “Hornets Nest” is peculiar owing to its destructive attack strategy. Though, the campaign doesn’t appear as sophisticated compared to say a zero day, it does however deploy six malware exploits in a single attack with the aim of exploit.
In brief, the attack begins with the ‘Legion Loader’ – the malware dropper written in MS Visual C++ 8 exhibits numerous VM/Sandbox and other features to stay under the radar from researchers. Yet, it lacks string obfuscation.
Upon execution, the Legion Loader then infects the victim machine with further malware. These include the commercially available infostealers such as Vidar, Predator the Thief and Racoon stealer, and cryptominer. In addition, it also exhibits a built-in cryptocurrency stealer, and RDP backdoor that permits additional attacks in future.
Whilst researcher found this campaign relatively less-sophisticated, possibly due to the lack of code obfuscation which made the analysis easier.
The presence of cryptominer and cryptostealer hint an an obvious incentive to make quick money. Whereas, the infostealers would surely benefit the attackers in the long run. The researchers also believe that such a wide-impact attack will be a ‘nightmare’ for enterprises.