Hodur Malware Has Ties to the Mustang Panda Hackers

A new malware family has been identified by cybersecurity researchers and, unfortunately, it appears to have been active for a long time. The threat, dubbed the Hodur Malware, is a product of an Advanced Persistent Threat (APT) actor tracked under the name Mustang Panda. The criminals specialize in attacks against various entities, including Internet service providers and diplomatic targets. The Hodur Malware campaigns are ongoing, and the latest traces of them date back to August 2021 – a sign that the criminals have managed to stay under the radar for a long time.

Of course, the Hodur Malware is not a threat that is used against regular users. The criminals behind the campaign are focusing on specific targets, and they prepare clever delivery techniques to make sure that their victims interact with the malicious file. It seems that the primary propagation method used to spread the Hodur Malware has been fraudulent email messages. The latter contain a malicious attachment, which is often masked as an important document.

The Hodur Malware's features are similar to those found in Remote Access Trojans (RATs.) Its operators gain ability to execute remote commands, as well as to interact with particular system services and features directly. Thanks to this, they can seamlessly exfiltrate data from infected machines, steal credentials, or spread laterally. It is important to add that the execution of the Hodur Malware is very complicated, and the malware takes tons of measures to minimize the odds that it will be analyzed by cybersecurity researchers. APT actors are no ordinary cybercriminals – they operate with high-quality, custom-built malware like Hodur. Their goal is to stay under the radar for as long as possible, and that's why their payloads often focus on being evasive more than anything. Thankfully, the Hodur Malware is easily stoppable with the use of up-to-date anti-malware software, and ensuring that the network is properly secured.