COLDRIVER using new malware to steal from Western targets — Google

Threat group COLDRIVER is using new malware to steal documents from Western targets, according to a May 7 report from Google Threat Intelligence. The malware, called LOSTKEYS, shows the evolution of the group from credential phishing to more sophisticated attacks.

According to the Google report, the new malware is installed through four steps. The process involves a “lure website” with a fake CAPTCHA, a PowerShell script downloaded to the user’s clipboard, some device evasion, and retrieval of the final payload. Lastly, the malware is installed.

LOSTKEYS payload delivery. Source: Google

LOSTKEYS is capable of stealing files from extensions and directories. It can also send system information and running processes back to COLDRIVER. The address from which the parts of the attack come is “165.227.148[.]68” according to Google.

The company says it has already taken steps to mitigate any damage the LOSTKEYS malware will

Read More at https://cointelegraph.com/news/coldriver-new-malware-steal-western-targets-google?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound