Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Evolution of Valak, from Its Beginnings to Mass Distribution

Summary: Unit 42 reports that Valak, an information stealer and malware loader first noted in late 2019, was pushed through the Shathak/TA551 email distribution network at a rate of two to four waves per week on average from April through June 2020. The infection chain begins when a victim enables macros on a malicious Word document, which fetches a Valak DLL, and in tests from a U.S. location on a vulnerable Windows 10 host returned IcedID as follow-up malware, with one Windows 7 case delivering both IcedID and NetSupport Manager RAT.

Bottom line: Valak hides follow-up malware in Alternate Data Streams and persists through scheduled tasks and registry updates, so an unprotected Windows host can be infected and loaded with a banking Trojan like IcedID within minutes of a user enabling macros.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related