New RomCom Variant 'SnipBot' Targets Data Theft Across Multiple Sectors
A dangerous new variant of the RomCom malware, dubbed 'SnipBot', has been spotted in sophisticated data theft attacks. Researchers from Palo Alto Networks' Unit 42 discovered this enhanced version, marking it as RomCom 5.0, and highlighting its ability to steal sensitive data from compromised systems while pivoting on networks to extend the attack.
- Extended Command Set: SnipBot brings 27 new commands that enable precise targeting of file types and directories for data exfiltration. This includes compressing stolen data using 7-Zip and using archive payloads for evasion.
- Advanced Anti-Sandboxing Techniques: SnipBot employs new tricks such as hash checks on executables and checking "RecentDocs" and "Shell Bags" registry keys to evade sandbox detection, further complicating analysis and mitigation.
- Obfuscation via Window Message Control Flow: The malware uses window message-based control flow obfuscation, making it harder to analyze by splitting its code into blocks triggered in sequence.
- Phishing and Fake Download Sites: The attack vectors include phishing emails with links to download files like PDFs, and older vectors involve fake Adobe sites tricking users into downloading malicious files. The attackers use legitimate certificates to evade security warnings when delivering malware from compromised file-sharing platforms.
- Stealthy Persistence and Data Theft: Once embedded in a system, the malware uses COM hijacking to inject its payload into "explorer.exe," ensuring persistence across reboots. It then steals files from Documents, Downloads, and OneDrive directories, leveraging tools like AD Explorer to gather network information and PuTTY Secure Copy client for data exfiltration.
The evolution of RomCom into SnipBot reflects the growing sophistication of malware in data theft and espionage campaigns. With new stealth features, network-pivoting capabilities, and targeted sector attacks (including IT, legal, and agriculture), organizations must remain vigilant and strengthen their security protocols to counter this advanced threat.
Comment(s)
Categories
- Other (42)
- Ransomware (116)
- Events and News (25)
- Features (44)
- Security (413)
- Tips (79)
- Google (22)
- Achievements (7)
- Products (31)
- Activation (7)
- Dealers (1)
- Bank Phishing (42)
- Malware Alerts (174)
- Cyber Attack (215)
- Data Backup (11)
- Data Breach (74)
- Phishing (130)
- Securty Tips (1)
- Browser Hijack (16)
- Adware (15)
- Email And Password (67)
- Android Security (53)
- Knoweldgebase (37)
- Botnet (15)
- Updates (3)
- Alert (70)
- Hacking (56)
- Social Media (7)
- vulnerability (50)
- Hacker (31)
- Spyware (8)
- Windows (5)
- Microsoft (21)
- Uber (1)
- YouTube (1)
- Trojan (2)
- Website hacks (3)
- Paytm (1)
- Credit card scam (1)
- Telegram (3)
- RAT (4)
- Bug (3)
- Twitter (2)
- Facebook (7)
- Banking Trojan (4)
- Mozilla (2)
- COVID-19 (5)
- Instagram (2)
- NPAV Announcement (5)
- IoT Security (1)
- Deals and Offers (1)
- Cloud Security (7)
- Offers (5)
- Gaming (1)
- FireFox (2)
- LinkedIn (2)
- WhatsApp (4)
- Amazon (1)
- DMart (1)
- Payment Risk (4)
- Occasion (2)
- firewall (1)
- Cloud malware (2)
- Cloud storage (2)
- Financial fraud (4)
- Impersonation phishing (1)
- DDoS (4)
- Smishing (2)
- Whale (0)
- Whale phishing (3)
- WINRAR (2)
- ZIP (1)
Recent Posts
Archive
Tags
cyber attack
phishing
data breach
ransomware
ransomeware
android malware
cyber security
data stealing
ddos
twitter
india
phishing email
microsoft
cert-in
cybercrime
malware
pune
vulnerability
cyber crime
independence day
occasion
hacking
financial security
telegram
phishing scam
android apps
financial fraud
cyber attack in india
data security
scam
clop gang
pakistani hackers
clop gang extorting
google play store
play store
fedex
user data leak
microsoft team
android
pakistan-backed hacker
whatsapp
clop
malicious apps
email phishing
december cyber attacks
lockbit
cert
cryptojacking
ddos attack
winrar