June 12 – Dubbed WarmCookie, this threat provides cyber attackers with initial access into targeted systems. Once in systems, attackers frequently launch ransomware attacks.

How the campaign works

Cyber attackers begin by sending victims phishing emails. These emails contain information about new job opportunities and attempt to convince interested parties to click on links to see role descriptions.

As you’ve guessed, this results in WarmCookie deployment. But there’s nothing warm and satisfying about this campaign. The campaign might have been more aptly named “BitterBiscuit.”

Malware maneuvers

Cyber security researchers have observed a similar malware type in the past and believe that WarmCookie may be a reincarnated version of said malware.

WarmCookie’s malware isn’t particularly advanced, but the threat is considered significant. The malware is being used to disrupt organizations worldwide. It employs methods like custom encryption, dynamic code loading and anti-analysis checks in order to evade detection.

Technical information

In terms of the technicalities, WarmCookie is a two-stage “lightweight backdoor” that offers hackers access to victim info, screenshot recording, victim monitoring and the potential for the deployment of a range of different payloads.

The first stage occurs after the PowerShell download of the malware. A backdoor enables itself to run with system privileges from the Task Scheduler Engine. The malware’s second stage results in backdoor functionality – it involves DLL integration with the command line (Start /p) to green-light execution.

Cyber security safeguards

Cyber security professionals are advised to beware of WarmCookie attacks, which may evolve in sophistication as developers sprinkle additional capabilities throughout the software. To proactively prevent this:

• Implement advanced email security solutions
• Limit the use of living-off-the-land binaries, like PowerShell
• Maintain up-to-date endpoint protection
• Monitor for indicators of compromise and persistence mechanisms
• Educate end-users about related phishing attempts

A prevention-first strategy that combines technical controls with user awareness is the way to go. For more on this story, click here.

Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.