Hackers use open source Microsoft dev platform to deliver trojans

Microsoft's Build Engine is being used to deploy Remcos password-stealing malware

Hackers have abused an open source development tool provided by Microsoft to deliver password-stealing trojans to unsuspecting victims.

Security researchers at Anomali Threat Research observed a new campaign whereby threat actors used Microsoft Build Engine (MSBuild) to filelessly deliver the Remcos remote access tool (RAT) and password-stealing malware commonly known as RedLine Stealer.

Researchers said the campaign appeared to have begun in April this year and was ongoing. Hackers used MSBuild — a tool used for building apps and gives users an XML schema “that controls how the build platform processes and builds software” — to deliver RemcosRAT and RedLine stealer using callbacks.

The files delivered contained encoded executables and shellcode — some were hosted on Russian image-hosting site, “joxi[.]net.” While researchers couldn’t determine the distribution method of the .proj files, these files’ objective was to execute either Remcos or RedLine Stealer. Most of the malware analyzed delivered Remcos as the final payload.

Once installed on the victim’s computer, the Remcos trojan allows hackers to remote control, remote admin, remote anti-theft, remote support, and pentest a machine.

Related Resource

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Cyber resilience for dummies - How to improve cyber resilience within your organisation - whitepaper from MimecastDownload now

While Remcos is commercial software created by Breaking Security, hackers often use it for malicious purposes. Researchers said the software enables full access to the infected machine with features like anti-AV, credential harvesting, gathering system information, keylogging, persistence, screen capture, script execution, and more.

The other malware observed in the campaign is Redline Stealer. This malware is written in .Net and when installed on a victim’s system, it can steal multiple types of data, such as cookies, credentials, crypto wallets, NordVPN credentials, stored web browser information, and system information. It will also search for multiple products, including cryptocurrency software, messaging apps, VPNs, and web browsers.

Using MSBuild allows hackers to evade detection while installing malicious payloads directly to a targeted computer's memory.

"The threat actors behind this campaign used fileless delivery as a way to bypass security measures, and this technique is used by actors for a variety of objectives and motivations," said researchers.

"This campaign highlights that reliance on antivirus software alone is insufficient for cyber defense, and the use of legitimate code to hide malware from antivirus technology is effective and growing exponentially."

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

What is a web filter?
cyber security

What is a web filter?

24 Sep 2021
100 million IoT devices affected by zero-day flaw
Internet of Things (IoT)

100 million IoT devices affected by zero-day flaw

24 Sep 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
New FamousSparrow hacking group caught targeting hotels
vulnerability

New FamousSparrow hacking group caught targeting hotels

24 Sep 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
London ranks second to Silicon Valley as world's best startup hub
startups

London ranks second to Silicon Valley as world's best startup hub

22 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021