Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

Summary: Unit 42 Palo Alto Networks discovered a new Windows malware family it named Airstalk, in PowerShell and .NET variants, and assesses with medium confidence that a possible nation-state actor used it in a likely supply chain attack tracked as activity cluster CL-STA-1009. Airstalk abuses the AirWatch (Workspace ONE) MDM API, using the devices endpoint's custom attributes as a dead drop for covert command-and-control and the blob upload endpoint to exfiltrate data including browser cookies, with the .NET variant more capable and further developed than the PowerShell one.

What you should know: The malware hides its command-and-control inside a trusted systems management tool, so bundling cookie theft into it allows execution without raising suspicion where standalone information stealers like Lumma and StealC would likely fail in a well-protected environment. Unit 42 also notes a notable increase in attacks on business process outsourcing providers, whose staff hold extensive access to client systems on equipment outside those clients' security controls.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related