What is Screenshotter Malware?
In October 2022, security company Proofpoint first noticed a progression in financially motivated activities that it calls "Screentime". The attack commences with an email that includes either a harmful attachment or link, leading to malware named WasabiSeed and Screenshotter.
Proofpoint has also seen instances of post-exploitation activity utilizing AHK Bot and Rhadamanthys Stealer.
Researchers are tracking these activities under the name TA866, which they believe to be a well-organized group that carries out systematic attacks on a large scale, equipped with custom tools and the capability to acquire additional tools and services from other sources.
The research team with Proofpoint has identified the following types of malicious email campaigns:
- Macros embedded in Publisher (.pub) attachments
- URLs linking to Publisher files with macros via a 404 TDS
- URLs linking to JavaScript files via a 404 TDS
- PDFs with URLs linking to JavaScript files via a 404 TDS
Initially, the campaigns during October and November 2022 were limited to a small number of emails targeting a few companies. The campaigns took place approximately once or twice a week and the emails contained attached Publisher files. However, when the threat actor shifted to using URLs in November and December 2022, the operation grew significantly, with campaigns featuring thousands to tens of thousands of emails and taking place two to four times a week. In January 2023, the campaign frequency decreased but the email volume increased even more.
How can you protect your system from malware like the malicious tools used by Screentime?
To protect your system from malware like the ones used by Screentime, it is important to follow best practices for cybersecurity. Some of these include: keeping your operating system and software up-to-date, avoiding clicking on suspicious links or attachments in emails, using strong and unique passwords, regularly backing up important data, and using a reputable antivirus software. Additionally, you should educate yourself and your employees about phishing scams and be wary of unexpected emails, even if they appear to come from a trusted source. Staying informed about the latest security threats and adopting a multi-layered approach to security can help you better protect your system against malware attacks.
