Wikiloader

WikiLoader is a sophisticated malware that has been used in notable campaigns identified by HP Wolf Security. It exploits open redirect vulnerabilities within websites to circumvent detection, a tactic known as 'Cat-Phishing'. The malware has been particularly active in Italy, where it's being used in phishing campaigns with the goal of installing Ursnif, a banking Trojan, stealer, and spyware. A significant example of this was when a fake parcel delivery PDF was used to trick users into installing the Ursnif malware. Additionally, a rise in PDF threats has been observed, with cybercriminals spreading malware, including WikiLoader, Ursnif, and DarkGate, through these files. The malware has been deployed since December by TA544 and TA551 threat operations targeting Italian organizations, as reported by The Record, a news site by cybersecurity firm Recorded Future. The WikiLoader campaigns have demonstrated a high level of operational security and robustness, leveraging a mix of spoofed, compromised, and legitimate infrastructure. This includes multiple command-and-control (C2) configurations and the use of SHA-256 hashes for the WikiLoader backdoor and shellcode loader DLLs. In one instance, the decryption key to the payload of the WikiLoader sample was provided by a C2. Researchers predict that the use of WikiLoader will likely continue throughout 2024 and beyond. One hypothesis for its continued use is that an initial access broker (IAB) has begun to work with WikiLoader to operationalize its delivery through search engine optimization (SEO) poisoning in recent months. However, the exact reason why threat actors have shifted from phishing to SEO poisoning to deliver WikiLoader remains unclear. Financially motivated threat actors are expected to continue using WikiLoader as a loader for rent in various campaigns due to its robustness, stealth, and reasonable attention to operational security.