BazaLoader Backdoor is back, This time gets downloaded via Fake Movie Streaming Site.

Bazaloader backdoor is back after a year, This time gets downloaded and executed via Fake movie streaming site. IOC’s included. Apply Fast.

Tweet

The security researchers from Proofpoint has identified the new variant of Bazaloader backdoor downloaded and executed via BazaLoader campaign with the required human interaction.

Malware campaign which was observed during May 2021 has been disguised as Movie streaming service with the fake website featured with fake movies.

The researchers had stated ” The campaign demonstrates an inversely proportional relationship between successful infection rates and asking people to complete complicated steps – the more steps required by the user, the less likely they are to complete the attack chain. However, despite being counterintuitive, the techniques used by the threat actors in this, and similar, campaigns help bypass fully automated threat detection systems. Additionally, leveraging a streaming service cancellation lure preys on a growing trend of users cancelling online entertainment following major growth in the industry during 2020.”

Infection Chain

The email received by the victim seems to be from multiple sender address with subjects like “Your trial period M0012064753012345 is going to be expired soon. Thankfully you made a decision to stick with us!” & “Demo stage is expired! Your account #M0272028060812345 will be automatically transferred to premium plan!”

“The emails contain phone numbers and references to the “BravoMovies” company. The messages purport to inform the target their credit card will be charged unless they cancel their subscription to the service. If the user calls the phone number provided in the email, a customer service representative will verbally guide the user to the company’s alleged website. The website is a convincing representation of a movie and television streaming service. ” stated by the Proofpoint researchers.

When the victim visits the fake site and navigate to unsubscribe options . On clicking the unsubscribe / Cancel option, the website download the malicious excel sheet with macro to the victim machine. Upon enabling the macro on sheet , the backdoor gets downloaded to the victim machine.

CyberWorkx readers can find the IOC’s for BazaLoader backdoor on below table.

–-For more Cyber security news in crisp content . Please follow our site