Novel Malicious Software Poses as Palo Alto VPN Targeting Users in the Middle East
.jpg "New Malware Masquerades as Palo Alto VPN Targeting Middle East Users")
Cybersecurity experts revealed a recent operation likely aimed at individuals in the Middle East using malicious software disguised as the Palo Alto Networks GlobalProtect virtual private network (VPN) application.
“The malicious software has the capability to perform remote PowerShell commands, retrieve and move files, encode communications, and circumvent sandbox solutions, posing a major risk to specific organizations,” Trend Micro investigator Mohamed Fahmy stated in a detailed analysis.
The sophisticated harmful program example has been seen following a dual-stage process, which includes creating links to command-and-control (C2) infrastructure that claims to be a corporate VPN gateway, enabling the malicious actors to function without setting off any alerts.
The original method of entry for the operation is presently undisclosed, though it is suspected to involve the utilization of deceptive methods such as phishing to mislead users into believing they are installing the GlobalProtect agent. The source of the activity has not been linked to a particular threat actor or collective.
The initial deployment involves a setup.exe binary that installs the primary undercover element called GlobalProtect.exe, which, upon installation, commences a signaling process that informs the operators of the status.
The primary executable is also responsible for placing two additional setup files (RTime.conf and ApProcessId.conf) that are used to transfer system data to a C2 server (94.131.108[.]78), including the target’s IP address, OS data, username, device name, and timing sequences for idle periods.
“The malware leverages an evasion maneuver to resist behavior analysis and sandbox solutions by examining the process file path and the specific file before triggering the primary code block,” Fahmy remarked.
The covert channel facilitates the uploading of files, fetching subsequent-level payloads, and executing PowerShell directives. The communication with the C2 server is facilitated by means of the Interactsh freely accessible initiative.
“The malicious software transitions to a recently registered URL, ‘sharjahconnect’ (likely connected to the U.A.E. emirate Sharjah), designed to resemble an authentic VPN gateway for a U.A.E.-based company,” Fahmy disclosed.
“This strategy aims to integrate the malicious activities of the malware with expected regional network traffic to improve its camouflage capabilities.”
About Author
