RedEnergy Stealer-as-a-Ransomware Threat Targeting Energy and Telecom Sectors

[silversurfer]

Content source

https://thehackernews.com/2023/07/redenergy-stealer-as-ransomware-threat.html

A sophisticated stealer-as-a-ransomware threat dubbed RedEnergy has been spotted in the wild targeting energy utilities, oil, gas, telecom, and machinery sectors in Brazil and the Philippines through their LinkedIn pages.

The malware "possesses the ability to steal information from various browsers, enabling the exfiltration of sensitive data, while also incorporating different modules for carrying out ransomware activities," Zscaler researchers Shatak Jain and Gurkirat Singh said in a recent analysis.

The goal, the researchers noted, is to couple data theft with encryption with the goal of inflicting maximum damage to the victims.

The starting point for the multi-stage attack is a FakeUpdates (aka SocGholish) campaign that tricks users into downloading JavaScript-based malware under the guise of web browser updates.

What makes it novel is the use of reputable LinkedIn pages to target victims, redirecting users clicking on the website URLs to a bogus landing page that prompts them to update their web browsers by clicking on the appropriate icon (Google Chrome, Microsoft Edge, Mozilla Firefox, or Opera), doing so which results in the download a malicious executable.

 

[Sandbox Breaker]

Ransom Stealers! This is getting very very interesting and deadly.
As defenders... We need to prepare for literally every type of threat. It saddens me to see so many other security strategies/threat models only focus on Ransomware. Alot of IT and Security depts are just getting used to the idea of an stealer

 

[HarborFront]

Ransom Stealers! This is getting very very interesting and deadly.
As defenders... We need to prepare for literally every type of threat. It saddens me to see so many other security strategies/threat models only focus on Ransomware. Alot of IT and Security depts are just getting used to the idea of an stealer

Yup, for now, ransomware and stealers are what we should be protecting our system from

 

[Sandbox Breaker]

Yup, for now, ransomware and stealers are what we should be protecting our system from

What's about RATs. Definately on my scope as my customers are prone to espionage and IP risks. I try to cover all threats. I'll never limit myself to just Ransomware or Stealers. The portfolio of threats is vast and too many to ignore. We cant rely on these Tier 1 SOC's the only perform alert regurgitation.

Things like backdoored system files and replaced kernal modules never get looked at. It takes a good Analyst like @struppigel & @Trident and myself to be really thorough in the investigating and defence process.

Further more: UEFI signature checking, active security research to ensure your not running backdoored Gigabyte Motherboard from that attack. It's all holistic. It takes a true master to understand this.

 

[HarborFront]

What's about RATs. Definately on my scope as my customers are prone to espionage and IP risks. I try to cover all threats. I'll never limit myself to just Ransomware or Stealers. The portfolio of threats is vast and too many to ignore. We cant rely on these Tier 1 SOC's the only perform alert regurgitation.

Things like backdoored system files and replaced kernal modules never get looked at. It takes a good Analyst like @struppigel & @Trident and myself to be really thorough in the investigating and defence process.

Further more: UEFI signature checking, active security research to ensure your not running backdoored Gigabyte Motherboard from that attack. It's all holistic. It takes a true master to understand this.

You should have a strong AV/AM or endpoint to protect against malware infection. Also, protect your system from hacking.

 

[Sandbox Breaker]

You should have a strong AV/AM or endpoint to protect against malware infection. Also, protect your system from hacking.

That's standard.