Microsoft issued a serious warning about the new form of stealthy fileless Malware campaign “Nodersok” that attacks windows computers using living-off-the-land techniques.
Living-off-the-land Binaries (LOLBin) technique refers to the abuse of legitimate windows tools and uses it to maintain its persistence and performing other malicious activities in the targeted windows machine.
Microsoft researchers are continuously following this campaign for several weeks and confirms that the malware has infected thousands of victims around the world and mainly targeting victims in the United States and Europe.
Threat actors employes the advanced fileless technique with this malware campaign that helps to easily penetrate the network and silently relies on the network infrastructure.
Researchers have initially uncovered this malware campaign in July through Microsoft defender telemetry data, and confirm that the Nodersok attack various sectors including Healthcare, Finance, Transport, Aerospace, Education and more.
Nodersok campaign mainly delivers 2 legitimate tools to infection the machine. one is Node.exe, a popular Node.js framework that is used in many apps and another one is WinDivert, a network capture utility.
These tools are neither malicious nor vulnerable but it provides some interesting features and Nodersok installs a pair of very peculiar tools using this fileless capability and changes the infected machines into zombie proxies.
Nodersok Malware Infection Chain
Attackers drop the HTA file through malicious ads and compromised websites into the victim’s machine, and the Javascript code that resides in the HTA file downloads the second stage component which is also another Javascript code.
Threat actors are particularly choosing the legitimate content delivery service Cloudfront which is not a malicious service but it helps the attacker to keep the detection alarm silent.
Researchers have learned that the same strategy was also used by the Astaroth campaign and the attacker abusing the legitimate storage.googleapis.com service.
Once the malware has launched the second stage of component, it downloads the new PowerShell command by hiding the encoded command text inside of the environment variable.
The Powershell command downloads and runs the additional encrypted components that will attempt to disable the Windows Defender antivirus program and windows updates.
Another binary Shellcode attempt to perform the elevation of system privileges and also download the legitimate node.exe tool from the official nodejs.org website.
According to Microsoft research, ” This last JavaScript is the actual final payload written for the Node.js framework that turns the device into a proxy. This concludes the infection, at the end of which the network packet filter is active and the machine is working as a potential proxy zombie. “
