SolarMarker Malware Uses Novel Techniques To Persist On Hacked Systems
In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.
Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.
Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.
Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.
The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.
"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.
The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.
"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."
What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.
The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.
"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."
Related articles- Pentest Tools Review
- Hack Tools For Windows
- Pentest Tools List
- Nsa Hack Tools
- Usb Pentest Tools
- Hacker Tools Software
- Pentest Tools Linux
- Hacker Tools Hardware
- Hack Tools Mac
- Physical Pentest Tools
- Pentest Recon Tools
- Hacker Tools Github
- Pentest Tools Github
- Hacker Tools List
- Hackers Toolbox
- How To Hack
- Hacking Tools Windows 10
- Pentest Tools Nmap
- Physical Pentest Tools
- Pentest Automation Tools
- New Hack Tools
- Hacker Tools Free Download
- Pentest Tools Tcp Port Scanner
- Nsa Hack Tools
- Hacker Tools
- Hack Tools For Mac
- Hack Tools For Pc
- Hacker Tools Github
- Hacking Tools For Games
- Game Hacking
- New Hack Tools
- Hacking Tools Usb
- Hack Tools Online
- Hack Tool Apk No Root
- Hackrf Tools
- Github Hacking Tools
- Hacker Tools Linux
- Hacks And Tools
- Blackhat Hacker Tools
- Hacking Tools Name
- New Hack Tools
- Pentest Tools For Mac
- Pentest Tools Alternative
- Pentest Tools Website
- Tools For Hacker
- Pentest Automation Tools
- Hacking Tools Software
- Tools 4 Hack
- Pentest Tools Alternative
- Hack Tools
- Hacker Tools For Pc
- Hak5 Tools
- Best Hacking Tools 2020
- Github Hacking Tools
- Hacker Tools For Windows
- Pentest Tools For Android
- Beginner Hacker Tools
- Hacker Tools Hardware
- Hacker Tools For Ios
- Hack Tools For Ubuntu
- How To Make Hacking Tools
- Pentest Recon Tools
- Hacker Tools Hardware
- Hacking Tools Software
- Nsa Hack Tools
- Hacking Tools Windows 10
- Hacking Tools 2020
- Hack Rom Tools
- Install Pentest Tools Ubuntu
- Hacker Tools For Mac
The Year In Review, Just The Leisure Time
Blog Posts
Technical Books
- Game Engine Black Book: Wolfenstein 3D - Between the high level of nostalgia and the fascinating topic, there was no way this book wasn't going to top this list. It's an incredibly well-done guide to how Wolfenstein 3D was made.
- Game Engine Black Book: Doom - Arguably, this book is even better than the Wolf3D one, but you should really read that one first so this one comes second. I highly recommend them both for anyone curious about how these legendary games were done on such feeble hardware.
- Rails AntiPatterns - I loved the tactic this book took of showing bad Rails code, explaining why it's bad, and then showing how to fix it. Some books do this sporadically without telling you in advance, but this worked so much better, knowing that each example was intentionally bad from the start so there was no confusion about what was the right way to do things.
- Data Smart - This was the most fun I've had reading a book on Excel spreadsheets. Not that I read many books on spreadsheets, but if I did this would definitely be the best. It's about implementing data science algorithms in Excel with humor, and it's so much better than it sounds.
- Don't Make Me Think Revisited - I enjoyed the first book, and the revised edition is just as good. Learn all about how to design user interfaces that make sense, and have a great time doing it.
- Structure and Interpretation of Computer Programs - A classic that still holds up today for teaching the fundamentals of programming and much more, this book has a steep learning curve, but the rewards match the effort it takes to get through it.
- The Hidden Reality - This was a super fun and mind-expanding read, taking us through the numerous types of multiverse concepts that have been thought up by cosmologists. Brian Greene continues his excellent, approachable writing style with this enjoyable book.
- Parallel Worlds - Michio Kaku does his own tour of the different types of multiverses we can conceive of, with a few more fantastical stories thrown in for good measure. This is another great book to read to get the high-level overview of this topic.
- Facts and Fallacies of Software Engineering - You don't have to agree with everything in a book for it to be excellent, and that's the case here with Robert L. Glass' thought-provoking arguments about the software engineering industry. Still relevant after 17 years.
- Professional CUDA C Programming - If you're interested in GPU programming and want to play around with your nVidia graphics card, this book has all the information you need to get started in a nicely written, diagrammed, and organized guide.
- Python Machine Learning - It's a solid introductory text on the fundamental machine learning algorithms, both in how they work mathematically, how they're implemented in Python, and how to use them in scikit-learn and TensorFlow.
- Data Science From Scratch - Fundamentals are so important to learning a topic well, and this book does a great job of teaching the fundamentals of data science by implementing the algorithms from scratch in Python.
- Seven Concurrency Models in Seven Weeks - I've loved every 7-in-7 Weeks book that I've read, and this one is no exception. It's an entertaining read through seven different ways to do concurrent programming with today's technology.
- The Non-Designer's Design Book - Learn how to design boldly in text and graphics with a few simple rules and clear, straightforward guidelines. Anyone and everyone who works around websites should give this quick read a look.
- Getting Clojure - If you're looking for a fun read and a tour of the Clojure programming language, this is the book to pick up.
- Effective Python - Every programming language has its beyond-the-beginner-level book on how to write programs in that language well, and this is the one to read for Python.
- Programming Elixir ≥ 1.6 - An excellent book for learning the ins and outs of this highly concurrent, fault-tolerant language, and it's well worth a read if you're operating in that domain.
- Metaprogramming Elixir - This book fills in the few gaps in Programming Elixir ≥ 1.6, and it's a great companion to that book.
- Programming Pearls 2 - This is a fairly decent algorithms book that's worth a read as a casual second or third book on programming algorithms.
- CUDA by Example - This book is clearly written, but not especially well-written. Still, it's a good introduction to CUDA programming that covers the basics. Just don't feel compelled to read it all the way through, as the later chapters are fairly useless.
- Learn Functional Programming With Elixir - Neither thorough on Elixir nor especially focused on teaching the unique aspects of functional programming, this book left a lot to be desired. It's fine, but not great in any respect.
- Programming Massively Parallel Processors - For a subject that is inherently interesting to me, this book managed to be tedious, verbose, and opaque in its explanations, and way, way, way too long. The necessary information is in there, but it's not worth the effort when there are better options available.
- The Rails 5 Way - This book was so much longer than it had to be. It was light on discussion and super heavy on documentation, as if it was simply a transcription of the online documentation into a book.
- How to Design Programs - Nearly 750 pages of the most tedious, drawn-out, agonizing explanations about learning to program, I disagree with the title given to this book. Nowhere in it does the reader learn how to design programs, maybe design of functions at best.
Novels
- The Way of Kings, Words of Radiance, Oathbringer - Wow. Just WOW. I could not believe how wonderful these books are. The characters are all flawed and broken and so human, the story drags you along as you watch in amazement at how everything develops, and the world that Brandon Sanderson built in this Stormlight Archive series is simply incredible. It has weight. It has life. It has history. I can't wait for the next book to come out.
- The Fifth Season, The Obelisk Gate, The Stone Sky - This trilogy is just as awesome as the Stormlight Archive series, and I was constantly amazed at how clearly written the world of the Stillness is. The fantastical powers that the orogenes and Guardians have could be confusing, but N. K. Jemisin writes so simply and beautifully that everything was crystal clear in my mind as I read it. The story is at the same time one of the most engrossing tales I've ever read and a powerful allegory about the struggles of racism in society. It's enlightening and revealing without being accusatory. Beautifully done.
- The Golden Compass, The Subtle Knife, The Amber Spyglass - Throughout this trilogy I was continually surprised by the incredible imagination of Philip Pullman. Each book brings entirely unique new elements into an already rich and diverse world, or rather many-worlds. Even with all of these new elements being introduced, the world always felt cohesive and real. Everything made sense within the context of the story. This is a hard thing to do right, and Pullman did it masterfully.
- The Eye of the World - I'm just getting started in this long Wheel of Time series, and I'm already hooked. The first book is essentially one long, thrilling chase through a world of mystery and magic. The reality of the world is revealed slowly, and the suspense of wondering when you'll find out that next tidbit of knowledge about the world was gripping. By the end I have more questions than answers, and I'm ready to learn more about the Wheel of Time.
- Snow Crash - This book was ridiculously fun, plain and simple. The setup makes no sense at all and the story doesn't care one whit about anything, but it doesn't matter. You're a pizza delivery boy in the future who also happens to be the world's best samurai swordsman and an elite haxxor. You get mixed up in some crazy shit and lots of weird stuff happens. It's a wild ride, and you're just going to have to read the book to see how it all works out.
- Jurassic Park - It's a book about man recreating dinosaurs in the modern age. What could go wrong? And what's not to like? This book is basically a classic at this point, and great fun to read.
- Ringworld - While the premise of this book was interesting—humans and aliens go visit an enormous world built in a ring around the aliens' host star—I just couldn't get into this book by Larry Niven. The story was only tangentially about the ringworld, and the main focus was actually about whether people could be bred for luck. It seemed like Niven wanted to write about building a ringworld, but couldn't figure out how to write a compelling story around that so he had to also write about this other thing to justify it. Also, his writing was too disjointed for my tastes. Scenes changed so abruptly and dialog and narration was so terse that I had trouble understanding what was going on most of the time. That was a huge disappointment, especially considering the other books on this list.
- The Color of Magic - This book was another disappointment, but for a different reason than Ringworld. The writing was fine, even funny sometimes, but the discworld made no sense at all. Completely random and nonsensical things would happen to the main characters at every turn, and I never could figure out what the plot was about. It didn't take long to lose interest in the characters altogether, since whatever happened to them wouldn't make any sense whatsoever and they were probably going to end up fine anyway. There were a lot of similarities in style to The Hitchhiker's Guide to the Galaxy, and while similar elements somehow worked there, they fell totally flat in The Color of Magic. That leaves me with no reason to read the other 40 books in the series, lucky me.
Video Games & Movies
The Year Ahead
18 Best Hacking Websites to Learn Ethical Hacking From Basic
- Black Hat: The Black Hat Briefings have become the biggest and the most important security conference series in the world by sticking to our core value: serving the information security community by delivering timely, actionable security information in a friendly, vendor-neutral environment.
- Offensive Security Training: Developers of Kali Linux and Exploit DB, and the creators of the Metasploit Unleashed and Penetration Testing with Kali Linux course.
- SecurityFocus: Provides security information to all members of the security community, from end users, security hobbyists and network administrators to security consultants, IT Managers, CIOs and CSOs.
- Hakin9: E-magazine offering in-depth looks at both attack and defense techniques and concentrates on difficult technical issues.
- Hacked Gadgets: A resource for DIY project documentation as well as general gadget and technology news.
- Makezine: Magazine that celebrates your right to tweak, hack, and bend any technology to your own will.
- NFOHump: Offers up-to-date .NFO files and reviews on the latest pirate software releases.
- KitPloit: Leading source of Security Tools, Hacking Tools, CyberSecurity and Network Security.
- The Hacker News: The Hacker News — most trusted and widely-acknowledged online cyber security news magazine with in-depth technical coverage for cybersecurity.
- Hack Forums: Emphasis on white hat, with categories for hacking, coding and computer security.
- Metasploit: Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit. Get the worlds best penetration testing software now.
- SecTools.Org: List of 75 security tools based on a 2003 vote by hackers.
- DEFCON: Information about the largest annual hacker convention in the US, including past speeches, video, archives, and updates on the next upcoming show as well as links and other details.
- HackRead: HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News with full-scale reviews on Social Media Platforms.
- Phrack Magazine: Digital hacking magazine.
- Hackaday: A hardware hack every day.
- Exploit DB: An archive of exploits and vulnerable software by Offensive Security. The site collects exploits from submissions and mailing lists and concentrates them in a single database.
- Packet Storm: Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers.








