Organizations across Europe have been targeted by a novel phishing campaign leveraging the DBatLoader malware loader, also known as NatsoLoader and ModiLoader, to facilitate the distribution of the Remcos RAT and Formbook malware strains, The Hacker News reports.
OneNote and HTML file attachments with multi-layered obfuscation have been used to enable the deployment of the DBatLoader payload, with the attacks utilizing mock trusted directories for User Account Control evasion and privilege escalation, according to a Zscaler report.
Attackers have been required to use a script to create Windows Explorer directories, which would then enable DLL payload loading. Such a process would obfuscate attackers' elevated activities as they establish persistence and evade detection by scanning systems through the inclusion of the "C:Users" directory to the Microsoft Defender exclusion list.
Users have been recommended to track process executions with filesystem paths, as well as set Windows UAC configuration to "Always notify" to avoid DBatLoader compromise.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.