This malware variant allows its operator to execute commands remotely, such as adding or deleting files, recording keystrokes, and gathering information.Īnother example of this is the ZAPIZ malware (Trojan.Win32. In April, we discovered an attack that used real Zoom installers that came with the RevCode WebMonitor RAT (). Interestingly, both compromised installers installed a legitimate version of Zoom, likely to hide evidence of malicious activity from the user.Īside from using compromised installers, we also found instances where malicious actors bundled legitimate installers with malware files.
The other sample () has an installer that consists of a file containing malicious commands. One of the malware samples () is a backdoor with remote access features, allowing the attacker to gain access to the infected machine to perform malicious actions, such as stealing information. The file size of malicious Zoom copies compared with that of the legitimate installer
While it could be difficult for the average user to distinguish the legitimate Zoom app from the fake ones, closer inspection shows that the malicious versions have significantly larger file sizes.įigure 1. We encountered an example of this in May, after we found samples of malware files that were disguised as fake Zoom installers. In some cases, the attackers use fake Zoom installers to trick users into installing them on their machines. The most common Zoom-related attack technique is the use of Zoom installers bundled with malware. On the other hand, we’ve encountered Zoom-related attacks that involve actual malware, which can potentially be more damaging to organizations and individuals. While annoying, Zoombombing is typically harmless in terms of security. The most well-known malicious activity involving Zoom is probably “Zoombombing,” which involves pranksters crashing a meeting and then performing disruptive actions, such as spamming pornographic content or even just generally being a nuisance. Given its high usage rate among schools, businesses, and individuals, it’s no surprise that cybercriminals have been focusing their efforts on Zoom-based attacks.
#SLACK DOWNLOAD ALL FILES SOFTWARE#
No other software has defined 2020 as much as the video conferencing app Zoom, which has exploded in popularity since the start of the pandemic. Zoom-based attacks have remained consistent While these apps have provided businesses a way of maintaining communication between employees, they have also caught the eye of malicious actors who are always looking to integrate new techniques in their malicious activities. In our 2020 midyear report, we discussed how the Covid-19 pandemic had forced many organizations to shift from physical offices to virtual ones - a change that also led to the rise of messaging and video conferencing apps as indispensable tools for communication.
0 kommentar(er)
