This is a clear indication that threat actors constantly shift their tactics and update defensive measures. The operators of SolarMarker’s information stealer/backdoor were found using stealthy techniques to ensure long-term persistence on compromised system systems.
Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.
Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim’s machines.
In August, malware targeted the education and healthcare sectors in an attempt to steal credentials and other sensitive information. Morphisec documented subsequent infection chains in August 2021 and highlighted the need for MSI installers to deliver the malware.
The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement or Nitro Pro, also launches a PowerShell script to deploy the malware.
“These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted,” Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.
The PowerShell install is intended to modify the Windows Registry, and to drop a.LNK file in Windows’ startup directory. This will establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a “smokescreen” of 100 to 300 junk files created specifically for this purpose.
” One would normally expect that this linked file is an executable, or script file,” researchers explained. “But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself.
What’s more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.
The backdoor is constantly evolving. It has a variety of functions that can steal data from web browsers and facilitate cryptocurrency theft. Additionally, it executes arbitrary commands or binaries which then are sent back to remote servers.
“Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later,” Gallagher said. “For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended. “