1 min read

Microsoft Help Files Are Being Used To Distribute This Spyware

Diana Lopera is a researcher for Trustwave Cybersecurity and has stumbled across something that’s one part interesting and one part disturbing.

Apparently, a group of hackers are trying a new approach to distribute their malicious code which is leveraging Microsoft’s HTML help files.

Yes, you read that correctly.  It’s an innovative technique that’s not only proving to be surprisingly effective, it is also proving to be notoriously difficult to detect. Even worse is that it’s not even a terribly sophisticated attack.

Here’s an overview of how it works:

Naturally, it begins with an email.  The email contains a generic subject line and an attachment, often entitled “Reques.doc” or similar.

This file is not a doc, but an .iso file.  A disk image.  The image contains a pair of files.  One of them is a Microsoft Compiled HTML Help file (CHM) and the other is an executable.

By exploiting the capabilities of the help file, the executable can install its malicious payload. In this case it is a malware strain called Vidar.

Vidar then establishes a link to its command-and-control server via Mastodon, which is a multi-platform open-source social networking system.  Once that connection has been established, Vidar goes to work harvesting user data from the infected system and exfiltrating it to the command-and-control server.

In at least one confirmed instance, Vidar was also spotted downloading and executing additional malware payloads.

Don’t Ignore This Serious Threat

Sophisticated or not, this new campaign has proved to be highly effective. Given that Vidar can serve as how other malware payloads wind up on an infected machine, this should be regarded as a serious threat.  Those “other payloads” could be anything from ransomware which will lock all the files on your network, to malicious code that has been optimized to steal banking information and everything in between.

Be sure your employees, friends, and family are aware and on their guard.  This is a nasty piece of code.

Used with permission from Article Aggregator

IT Threat Intelligence: Is Your Firm Seeing The Whole Picture?

IT Threat Intelligence: Is Your Firm Seeing The Whole Picture?

Law firms today are sitting on a digital goldmine. From sensitive client communications and trade secrets to financial records and intellectual...

Read More
Mastering Digital Evidence: How Law Firms Turn Data into Trial-Winning Proof

Mastering Digital Evidence: How Law Firms Turn Data into Trial-Winning Proof

In 2011, a jury found Casey Anthony not guilty of murdering her two-year-old daughter. Later reviews revealed two key digital-evidence failures:...

Read More
The Predictive Edge: Turning Case Management Data Into Litigation Strategy

The Predictive Edge: Turning Case Management Data Into Litigation Strategy

The legal world is changing faster than a judge can say "sustained." Gone are the days when successful litigation relied solely on courtroom...

Read More

Update Now If You Run This WordPress Plugin

Millions of people around the world have leveraged the awesome power of WordPress to build their sites. Whether for personal or business use,...

Read More

Microsoft Windows 11 Finally Has a Release Date

Are you excited at the prospect of Windows 11? If so then you will be pleased to know that Microsoft’s latest OS now has an official release date....

Read More

Microsoft Office Is Rolling Out a New User Interface

Microsoft is making a few UI changes across its entire product line in anticipation of rolling out Windows 11. Early this year (2021) the company...

Read More