DeepLoad Malware - AI-Generated Code Evades Detection

What Happened

A new malware campaign named DeepLoad has been discovered, combining ClickFix delivery methods with AI-generated code to evade detection. This persistent malware targets enterprise credentials, allowing attackers to steal user accounts and passwords. Researchers from ReliaQuest have identified this campaign as an immediate threat to businesses, highlighting its sophisticated techniques for maintaining access to compromised networks.

DeepLoad first appeared on dark web marketplaces in February, initially focusing on stealing cryptocurrency wallets. However, its recent shift towards enterprise credential theft indicates a broader targeting strategy. The attacks likely begin with links or files delivered through compromised websites or SEO-poisoned search results, tricking users into executing malicious commands on their own devices.

How It Works

DeepLoad employs advanced evasion techniques by embedding its malicious payload within meaningless variable assignments in the code. This makes it challenging for traditional file-based scanning tools to detect the malware. The significant volume of code suggests that AI assists in its generation, allowing for rapid alterations that further complicate detection efforts.

The malware disguises itself within legitimate Windows processes, such as the lock screen, to avoid detection by security tools. It also utilizes Windows Management Instrumentation (WMI) to maintain persistence, re-infecting machines three days after initial removal attempts. Additionally, there are indications that DeepLoad can propagate through USB drives, increasing its potential reach.

Who's Being Targeted

DeepLoad primarily targets enterprise environments, aiming to steal sensitive credentials and session tokens. Organizations that rely on Windows systems are particularly vulnerable due to the malware's ability to blend into regular operations. The use of ClickFix social engineering techniques means that employees may inadvertently facilitate the malware's entry by executing malicious commands.

The threat is compounded by DeepLoad's adaptability, as it can modify its code to evade detection continuously. This means that organizations must remain vigilant and proactive in their cybersecurity measures to counteract the evolving nature of this malware.

How to Protect Yourself

To defend against DeepLoad, network administrators should implement several key strategies. Enabling PowerShell Script Block Logging can help monitor and control script execution. Regularly auditing WMI subscriptions on exposed hosts is also crucial for identifying potential vulnerabilities.

In the event of an infection, it is vital to change the passwords of affected users immediately. Security teams should adopt behavior-based detection methods that can adapt quickly to the malware's changes. As DeepLoad evolves, organizations must prioritize robust detection and response strategies to mitigate its impact effectively.