Threat Alert: Hacking the Hackers

What's Happening?

Cybereason Nocturnus is investigating a campaign where attackers are trojanizing multiple hacking tools with njRat, a well known RAT. The campaign ultimately gives attackers total access to the target machine.

The threat actors behind this campaign are posting malware embedded inside various hacking tools and cracks for those tools on several websites. Once the files are downloaded and opened, the attackers are able to completely take over the victim’s machine. In this writeup, the Nocturnus team presents an analysis of the attacker TTPs and indicators of compromise. During this investigation, we uncovered hundreds of trojanized files and information about the threat actors infrastructure.

Read The Full Research

KEY OBSERVATIONS & TTPS

A Widespread Campaign: The Nocturnus team has found a widespread hacking campaign that uses the njRat trojan to hijack the victim’s machine, giving the threat actors complete access that can be used for anything from conducting DDoS attacks to stealing sensitive data.
Baiting Hackers: The malware is spreading by turning various hacking tools and other installers into trojans. The threat actors are posting the maliciously modified files on various forums and websites to bait other hackers.
Using Vulnerable WordPress Websites: The threat actors are hacking vulnerable WordPress installations to host their malicious njRat payloads.
Creating a “Malware Factory”: It seems as if the threat actors behind this campaign are building new iterations of their hacking tools on a daily basis.

Threat Alert:

Hacking the Hackers

Threat Overview

What's Happening?

KEY OBSERVATIONS & TTPS

Remediation Steps

CYBEREASON CUSTOMERS

Future-Ready Cybersecurity Protection

Threat Alert:

Hacking the Hackers

Threat Overview

What's Happening?

KEY OBSERVATIONS & TTPS

Remediation Steps

CYBEREASON CUSTOMERS