The menace actors behind the PikaBot malware have made important modifications to the malware in what has been described as a case of “devolution.”
“Though it seems to be in a brand new improvement cycle and testing part, the builders have lowered the complexity of the code by eradicating superior obfuscation strategies and altering the community communications,” Zscaler ThreatLabz researcher Nikolaos Pantazopoulos mentioned.
PikaBot, first documented by the cybersecurity agency in Might 2023, is a malware loader and a backdoor that may execute instructions and inject payloads from a command-and-control (C2) server in addition to enable the attacker to regulate the contaminated host.
Additionally it is identified to halt its execution ought to the system’s language be Russian or Ukrainian, indicating that the operators are both based mostly in Russia or Ukraine.
In current months, each PikaBot and one other loader known as DarkGate have emerged as engaging replacements for menace actors similar to Water Curupira (aka TA577) to acquire preliminary entry to focus on networks by way of phishing campaigns and drop Cobalt Strike.
Zscaler’s evaluation of a brand new model of PikaBot (model 1.18.32) noticed this month has revealed its continued concentrate on obfuscation, albeit with easier encryption algorithms, and insertion of junk code between legitimate directions as a part of its efforts to withstand evaluation.
One other essential modification noticed within the newest iteration is that the whole bot configuration — which is analogous to that of QakBot — is saved in plaintext in a single reminiscence block versus encrypting every aspect and decoding them at runtime.
A 3rd change issues the C2 server community communications, with the malware builders tweaking the command IDs and the encryption algorithm used to safe the visitors.
“Regardless of its current inactivity, PikaBot continues to be a big cyber menace and in fixed improvement,” the researchers concluded.
“Nevertheless, the builders have determined to take a unique strategy and reduce the complexity stage of PikaBot’s code by eradicating superior obfuscation options.”
The event comes as Proofpoint alerted of an ongoing cloud account takeover (ATO) marketing campaign that has focused dozens of Microsoft Azure environments and compromised tons of of consumer accounts, together with these belonging to senior executives.
The exercise, underway since November 2023, singles out customers with individualized phishing lures bearing decoy recordsdata that comprise hyperlinks to malicious phishing internet pages for credential harvesting, and use them for follow-on information exfiltration, inside and exterior phishing, and monetary fraud.
