Website Contact Form Used To Spread BazarBackdoor Malware

Share post:

According to Abnormal Security analysts, attackers are using BazarBackdoor to target corporate victims. The goal here is to deploy Cobalt Strike or ransomware payloads.

The threat actors use corporate contact forms to initiate communications in a bid to evade security software.

BazarBackdoor is under development by the Conti ransomware operations. The backdoor malware allows attackers to gain remote access to an internal device. This access can then be used to spread access within a network.

Once victims respond to attackers’ disguise sent via corporate contact forms, they send back a malicious ISO file disguised as part of the negotiation process.

The ISO archive attachment contains a .lnk file and a .log file. The payloads are packed in the archive prompting the victim to extract them after download.

The .lnk file contains a command instruction that opens a terminal window using existing Windows binaries and loads the .log file, which is, in reality, a BazarBackdoor DLL.

For more information, read the original story in BleepingComputer.

Featured Tech Jobs

SUBSCRIBE NOW

Related articles

All Okta customer support users had their email addresses copied

Identity and access provider Okta now says the threat actor who accessed its customer help desk system last month got the names and email addresses of all contacts of organizations that use its support system. Originally, the company said that, after an investigation, it determined only one per cent of the contacts from its 18,000

Failure of technology to detect attacks is a prime cause of breaches: Survey

Despite the money being poured into cybersecurity by IT departments, the leading cause of breaches of security controls was the failure of technology to detect an attack, a new survey from Trellix suggests. Forty-two per cent of respondents to the international survey of infosec leaders whose organization had suffered a recent cyber attack said their

Canadian group gets $2.2 million to research AI threat detection for wireless networks

Ericsson Canada and three universities have been awarded funds by the National Cybersecurity

Cyber Security Today, Nov. 29, 2023 – More ransomware attacks on the healthcare sector

This episode reports on a company hit twice by a ransomware gang, the arrest in Ukraine of the alleged head of a ransomware gang

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways