9621 Agnes Crossing, Lake Suzanneview, New Mexico Island 84604-9295.
A Russian hacking group known as Nodaria (UAC-0056) is using a new data-stealing malware called Graphiron to steal data from Ukrainian organizations. Go-based malware can collect a wide
A Russian hacking group known as Nodaria (UAC-0056) is using a new data-stealing malware called Graphiron to steal data from Ukrainian organizations. Go-based malware can collect a wide variety of information, including account credentials, system and application data. The malware will also take screenshots and extract files from compromised machines. Symantec’s threat research team discovered that Nodaria used Graphiron for attacks from at least October 2022 to mid-January 2023.
Graphiron consists of a bootloader and an additional information stealing payload. Once the downloader is launched, it will check for various security software and malware analysis tools, and if none is found, it will download the stealing component. Some of the processes that the bootloader controls are BurpSuite, Charles, Fiddler, rcapd, smsniff, Wireshark, x96dbg, ollydbg and idag.
The malware uses names like OfficeTemplate.exe and MicrosoftOfficeDashboard.exe to look like a Microsoft Office component on a compromised system.
Its abilities include:
The malware uses the following PowerShell code to steal passwords from the Windows vault built into the system’s password manager, where stored credentials are stored in AES-256 encrypted format.
Graphiron uses AES encryption with hardcoded keys to communicate with the C2 server over port 443, which is a notable similarity to older Nodaria tools like GraphSteal and GrimPlant.
Nodaria is the same threat actor that launched devastating data destruction attacks in January 2022 by placing fake ransomware called “WhisperGate” on Ukrainian networks. Russian hackers often deliver their exploits to their targets via phishing emails, and the ongoing war offers many opportunities to set up an effective trap.
Source: Port Altele
As an experienced journalist and author, Mary has been reporting on the latest news and trends for over 5 years. With a passion for uncovering the stories behind the headlines, Mary has earned a reputation as a trusted voice in the world of journalism. Her writing style is insightful, engaging and thought-provoking, as she takes a deep dive into the most pressing issues of our time.
:quality(85)//cloudfront-us-east-1.images.arcpublishing.com/infobae/CVUTI7VPVZCGHDKTPRZMJMRR6Q.jpg "Apple’s Pay Later feature includes monthly and long-term payments")
