SolarMarker Malware Uses Novel Techniques To Persist On Hacked Systems

 In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.

Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.

Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.

Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.

The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.

"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.

The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.

"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."

What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.

The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.

"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."

Related news

1. Hacking Tools For Pc
2. Hacking App
3. Hacking Tools Pc
4. Hacker Tools Github
5. Tools 4 Hack
6. Hacker Search Tools
7. Pentest Tools Apk
8. Hacking Tools For Mac
9. Top Pentest Tools
10. Game Hacking
11. Hacker Tools For Ios
12. Pentest Tools Free
13. Easy Hack Tools
14. Hacking Tools Free Download
15. Pentest Tools For Mac
16. Hak5 Tools
17. Usb Pentest Tools
18. Hacker Tools Windows
19. Hack And Tools
20. Hack Rom Tools
21. Hacking Tools Mac
22. Hacker Tools Online
23. Hack Tools
24. Wifi Hacker Tools For Windows
25. Pentest Tools Kali Linux
26. Hacking Tools Download
27. Nsa Hack Tools Download
28. Pentest Tools Website Vulnerability
29. Pentest Tools Url Fuzzer
30. Hacking Tools Free Download
31. Underground Hacker Sites
32. Pentest Tools For Ubuntu
33. Pentest Tools Website Vulnerability
34. Blackhat Hacker Tools
35. Hack Tools Online
36. Pentest Tools Port Scanner
37. Ethical Hacker Tools
38. Hacking Tools For Mac
39. Hacker Tools 2019
40. Nsa Hack Tools
41. Pentest Tools For Android
42. Android Hack Tools Github
43. Pentest Tools Url Fuzzer
44. How To Install Pentest Tools In Ubuntu
45. Pentest Tools Linux
46. What Are Hacking Tools
47. Pentest Tools Subdomain
48. Hackers Toolbox
49. Pentest Tools Find Subdomains
50. Hack Tools Online
51. Hacking Tools For Games
52. Hack Apps
53. Computer Hacker
54. Nsa Hack Tools
55. Hack Tools For Pc
56. Pentest Tools Apk
57. Pentest Recon Tools
58. Physical Pentest Tools
59. Hacks And Tools
60. Hacking Tools Usb
61. Hacker Tools 2019
62. Nsa Hack Tools
63. Pentest Tools Windows
64. Hack Tools Mac
65. Pentest Tools Free
66. Pentest Tools List
67. Hacking Tools 2019
68. Pentest Tools
69. Hacking Tools Pc
70. Hacker Tools Apk Download
71. Bluetooth Hacking Tools Kali
72. New Hacker Tools
73. Hacking Tools Pc
74. Hacking Apps
75. Physical Pentest Tools