Ethical Hacking News Hubb
Advertisement Banner
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
Wellnessnewshubb
No Result
View All Result
Home Ethical Hackers

GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry

admin by admin
February 6, 2023
in Ethical Hackers


Feb 06, 2023Ravie LakshmananCyber Attack / Endpoint Security

E-commerce industries in South Korea and the U.S. are at the receiving end of an ongoing GuLoader malware campaign, cybersecurity firm Trellix disclosed late last month.

The malspam activity is notable for transitioning away from malware-laced Microsoft Word documents to NSIS executable files for loading the malware. Other countries targeted as part of the campaign include Germany, Saudi Arabia, Taiwan and Japan.

NSIS, short for Nullsoft Scriptable Install System, is a script-driven open source system used to develop installers for the Windows operating system.

While attack chains in 2021 leveraged a ZIP archive containing a macro-laced Word document to drop an executable file tasked with loading GuLoader, the new phishing wave employs NSIS files embedded within ZIP or ISO images to activate the infection.

“Embedding malicious executable files in archives and images can help threat actors evade detection,” Trellix researcher Nico Paulo Yturriaga said.

GuLoader Malware

Over the course of 2022, the NSIS scripts used to deliver GuLoader are said to have grown in sophistication, packing in additional obfuscation and encryption layers to conceal the shellcode.

The development is also emblematic of a broader shift within the threat landscape, which has witnessed spikes in alternative malware distribution methods in response to Microsoft’s blocking of macros in Office files downloaded from the internet.

“The migration of GuLoader shellcode to NSIS executable files is a notable example to show the creativity and persistence of threat actors to evade detection, prevent sandbox analysis and obstruct reverse engineering,” Yturriaga noted.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

US manufacturing & utility businesses leaked nearly 38 million records in 136 data breaches in 2022

Next Post

What is my router’s IP address?

Next Post

What is my router's IP address?

Recommended

Static Taint Analysis Platform To Scan Vulnerabilities In An Android App

5 months ago

New Android Banking Trojan Targeting Brazilian Financial Institutions

2 months ago

© 2022 Ethical Hacking News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Ethical Hackers
  • Contact

Newsletter Sign Up.

No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact

© 2022 Ethical Hacking News Hubb All rights reserved.