[ad_1]
A brand new cross-platform backdoor referred to as “SysJoker” has been noticed focusing on machines operating Home windows, Linux, and macOS working programs as a part of an ongoing espionage marketing campaign that is believed to have been initiated in the course of the second half of 2021.
“SysJoker masquerades as a system replace and generates its [command-and-control server] by decoding a string retrieved from a textual content file hosted on Google Drive,” Intezer researchers Avigayil Mechtinger, Ryan Robinson, and Nicole Fishbein famous in a technical write-up publicizing their findings. “Primarily based on victimology and malware’s conduct, we assess that SysJoker is after particular targets.”
The Israeli cybersecurity firm, attributing the work to a complicated risk actor, stated it first found proof of the implant in December 2021 throughout an energetic assault towards a Linux-based net server belonging to an unnamed academic establishment.
A C++-based malware, SysJoker is delivered by way of a dropper file from a distant server that, upon execution, is engineered to assemble details about the compromised host, reminiscent of MAC handle, person identify, bodily media serial quantity, and IP handle, all of that are encoded and transmitted again to the server.
What’s extra, connections to the attacker-controlled server are established by extracting the area’s URL from a hard-coded Google Drive hyperlink that hosts a textual content file (“area.txt”), enabling the server to relay directions to the machine that permit the malware to run arbitrary instructions and executables, following which the outcomes are beamed again.
“The truth that the code was written from scratch and hasn’t been seen earlier than in different assaults [and] we have not witnessed a second stage or command despatched from the attacker […] means that the assault is particular which often suits for a complicated actor,” the researchers stated.
[ad_2]
