🎯Basically, hackers are using image files to secretly run malware without leaving traces.
What Happened
A recent report by GBHackers News reveals a sophisticated multi-stage PureRAT campaign that utilizes ordinary PNG images to execute malware without traditional file storage. This method is part of a broader trend in cyberattacks, where attackers aim to evade detection by using seemingly harmless files.
How It Works
The attack begins with a malicious LNK file that triggers a concealed PowerShell command. This command downloads a heavily obfuscated VBS file, designed to bypass security measures. Once executed, the VBS file copies itself and sets up a Task Scheduler job for persistence, ensuring the malware remains active even after a system reboot.
The PowerShell loader then establishes connections to hardcoded domains to fetch a PNG file containing a base64-encoded portable executable (PE) payload. Another PNG file is also downloaded, the contents of which are decoded and loaded directly into memory. This technique is particularly insidious as it avoids writing malicious files to disk, making detection more challenging.
Who's Being Targeted
This campaign appears to target organizations across various sectors, particularly those that may not have robust security measures in place. The use of fileless execution techniques suggests that the attackers are aiming for environments where traditional detection methods may fail.
Signs of Infection
Organizations should be on the lookout for:
Suspicious LNK-initiated PowerShell activity
cmstp.exe
Task Scheduler
How to Protect Yourself
To defend against this evolving threat, security teams should:
Detection
- 1.Monitor PowerShell execution logs for unusual commands
- 2.Implement strict controls on the use of LNK files and PowerShell scripts
Removal
Conclusion
The PureRAT campaign exemplifies the need for organizations to enhance their cybersecurity posture. By leveraging fileless techniques and common file types like PNGs, attackers are becoming increasingly sophisticated. Vigilance and proactive measures are essential to protect against such threats.
🔒 Pro insight: The use of fileless techniques in this PureRAT campaign indicates a shift towards stealthier attack vectors, requiring enhanced detection capabilities.
.webp)
