Xtreme RAT and Cryptominer delivered in pirated Windows Operating System
The Threat Response Unit (TRU) team of eSentire identified pirated Windows Operating System (OS) backdoored with CryptoMiner and Xtreme RAT. The TRU found that the behavior operated is identical to the one prescribed by Minerva Labs in mid-2021, which introduced ways to bypass Windows defender.
The Threat Response Unit (TRU) team of eSentire identified pirated Windows Operating System (OS) backdoored with CryptoMiner and Xtreme RAT. The TRU found that there were several malicious Windows services on the system which modified system permissions, disabled Windows defenders, and retrieved payloads from msz[.]su. According to the team, this behavior is identical to the one prescribed by Minerva Labs in mid-2021, which introduced ways to bypass Windows defender. The Security Operations Center (SOC) alarmed the customers of the malicious endpoint activity and offered suggestions for remediation and further forensic investigation.
About author
DW Team
The GIP Digital Watch Observatory team, consisting of over 30 digital policy experts from around the world, excels in the fields of research and analysis on digital policy issues. The team is backed by the creative prowess of Creative Lab Diplo and the technical expertise of the Diplo tech team.