Beware! PureCrypter Malware Distributed Through Discord
Security company Menlo Labs has issued a warning about a threat actor who is using PureCrypter downloader to distribute various forms of malware to government entities in the Asia-Pacific and North America regions.
As part of these attacks, the attackers are using Discord for distribution purposes, while a commandeered non-profit organization's domain is serving as a command-and-control (C&C) server to host a secondary payload. The targeted victims are being hit with a range of threats, including Redline Stealer, AgentTesla, Eternity, Blackmoon, and Philadelphia ransomware. PureCrypter is a sophisticated downloader that offers persistence and has been available for purchase since March 2021.
The threat is written in .NET, supports different injection types and defense mechanisms, and can be customized with fake messages and additional files. In the current campaign, the attackers are hosting PureCrypter on Discord and using email to send a link to the payload to the intended targets, while hiding the downloader inside password-protected ZIP files to bypass existing defenses. Once the PureCrypter loader is executed on the system, it attempts to fetch a secondary payload from a commandeered non-profit organization's website.
The payload has been identified as the AgentTesla information stealer, which is communicating with an FTP server in Pakistan to exfiltrate victim data. Menlo notes that the server was likely accessed using compromised credentials found online.
Why Are Threat Actors Using Third-Party Legitimate Platforms to Distribute Malware?
Threat actors are using third-party legitimate platforms, such as Discord, to distribute malware because these platforms provide a level of anonymity and make it difficult for security solutions to detect and block the malicious activity. By using these platforms, the attackers can create fake accounts or leverage legitimate ones to spread malicious links or files, which are often disguised as harmless content. Additionally, using third-party platforms provides the attackers with access to a large number of potential victims, making it easier for them to find and target vulnerable systems.
Furthermore, attackers often use legitimate domains as a command-and-control (C&C) server to evade detection, as traffic to these domains is less likely to be blocked by security solutions.
Overall, the use of third-party legitimate platforms allows threat actors to bypass security measures and more effectively deliver their malware to victims.
