Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New Solar Marker (Jupyter) Campaign Demonstrates the Malware’s Changing Attack Patterns

Summary: Unit 42 identified a new version of SolarMarker, an infostealer and backdoor malware family prevalent since September 2020 that targets U.S. organizations and is delivered mainly through SEO poisoning. The new campaign shows a shift from EXE to MSI files and back toward EXE, using a setup.exe dropper larger than 250MB to evade sandbox and AV inspection, with a PowerShell loader that reflectively loads an encrypted .NET backdoor and later an infostealer module.

What's compelling: The malware's 250MB dropper and reflective code loading are built specifically to slip past automated sandboxes and AV engines, and the backdoor checks its C2 server every 60 seconds for new instructions or payloads - so a single successful download can hand an attacker a persistent, remotely directed foothold inside the network.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related