The #WhisperGate malware discovered by Microsoft contains MSIL stub commonly used by commodity e-crime malware. We observed samples using the same stub that drop different malware families such as Remcos RAT, FormBook and others. #ESETresearch 1/5
https://twitter.com/MsftSecIntel/status/1482543129454686215
We believe that attackers used FUD crypting service from darkweb to make #WhisperGate malware undetected. This service has been abusing cloud providers like GitHub, Bitbucket, Discord to store its payload in encrypted form. 2/5
Automatic detection MSIL/TrojanDownloader.Agent_AGen.FP was made 4 days prior to the attack in #Ukraine 🇺🇦 based on samples with similar MSIL stub used in an unrelated campaign. ESET solutions successfully detected stage2 malware but stage1 was not observed in ESET telemetry 3/5
It is likely that attackers were trying to avoid existing detections at the last moment before the attack, that’s why they used third party criminal services 4/5
As such, pivots on the first steps of the chain are likely to lead to other samples packed with the same crypting service but, unrelated to #WhisperGate wiping malware #ESETresearch 5/5
• • •
Missing some Tweet in this thread? You can try to
force a refresh
