Wikiloader

WikiLoader, also known as WailingCrab, is a downloader malware first discovered in 2022 by Proofpoint and made public in 2023. This sophisticated malicious software is typically sold in underground marketplaces by an initial access broker (IAB) and is often spread through traditional phishing techniques. Notable campaigns include exploiting open redirect vulnerabilities within websites to avoid detection, and the increasing use of PDF threats, with cybercriminals spreading WikiLoader and other malware like Ursnif and DarkGate through PDF files, according to a report by HP Wolf Security. Italian organizations have been specifically targeted by phishing campaigns deploying WikiLoader, with the intention of installing Ursnif, a banking Trojan, stealer, and spyware. A notable example was a campaign that tricked users into installing Ursnif malware via a fake parcel delivery PDF. These attacks have been attributed to TA544 and TA551 threat operations since December. Additionally, cybercriminals have been posing as sellers of GlobalProtect, a virtual private network (VPN) software from Palo Alto Networks, and delivering a new variant of WikiLoader malware through search engine optimization (SEO) poisoning. In June 2024, Unit 42 detected a new WikiLoader campaign utilizing SEO poisoning as a novel spreading technique. The researchers hypothesized that this change might be due to a different IAB working with WikiLoader or a shift from phishing after improvements in endpoint security controls disrupted their operations. The robustness of WikiLoader campaigns, leveraging a combination of spoofed, compromised, and legitimate infrastructure, underscores the malware operators' focus on building an operationally secure loader with multiple command and control (C2) configurations. Despite these findings, the future of WikiLoader remains uncertain, with the authors suspecting its continued use throughout 2024 and beyond.