Nasty new malware strain creeps quietly past Windows defenses
Blister malware often remains undetected by antivirus engines
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Security researchers have identified a newmalwarecampaign that leverages code signing certificates and other techniques to help it avoid detection byantivirus software.
According to a newblog postfrom Elastic Security, the cybersecurity firm’s researchers identified a cluster of malicious activity after reviewing its threat prevention telemetry.
The cybercriminals behind this new campaign are using valid code signing certificates to sign malware to help them remain under the radar of the security community. However, Elastic Security also discovered a new malware loader used in the campaign that it has named Blister.
Due to the use of valid code signing certificates and other measures taken to avoid detection, the cybercriminals responsible have been running this new campaign for at least three months.
Blister malware
The cybercriminals are using a code signing certificate issued by the digital identity firmSectigofor a company called Blist LLC which is why Elastic Security gave their malware loader the name Blister. They may also be operating out of Russia as they are using Mail.Ru as theiremail service.
In addition to using a valid code signing certificate, the cybercriminals also relied on other techniques to remain undetected including embedding the Blister malware into a legitimate library. After being executed with elevated privileges by using the rundll32 command, the malware decodes bootstrapping code that is heavily obfuscated and stored in the resource section. From here, the code remains dormant for ten minutes to evadesandbox analysis.
Once enough time has passed, the malware starts up and begins decrypting embedded payloads that allow it to access a Windows system remotely and move laterally across a victim’s network. Blister also achieves persistence on an infected machine by storing a copy in the ProgramData folder as well as another posing as rundll32.exe. To make matters worse, the malware is added to a system’s startup location so it launches every time a machine boots.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Elastic Security has notified Sectigo to have Blister’s code signing certificate revoked though the firm has also created aYara ruleto help organization’s identify the new malware.
In an email toTechRadar Pro, Chief Compliance Officer at Sectigo, Tim Callan provided further details on the matter, saying:
“During the week of December 21, 2021, Sectigo was made aware of a code-signing certificate being used by the threat actor behind the recently discovered BLISTER malware. Upon discovering the issue, Sectigo immediately revoked the compromised certificate.
As one of the longest-standing publicly trusted Certificate Authorities, Sectigo takes careful precautions to ensure that every certificate we issue follows the guidelines set by the CA/Browser forum. Sectigo does not regulate, control, or monitor the business practices of any operator, nor do our services relate in any way whatsoever with the content distributed by a particular operator.”
We’ve also featured thebest malware removal software,best antivirusandbest endpoint protection software
ViaBleeping Computer
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
This new phishing strategy utilizes GitHub comments to distribute malware
Smeg Combi Steam Oven review: a multi-functional countertop oven that looks stunning and cooks well
