ECONOMY & WORK
MONEY 101
NEWS
PERSONAL FINANCE
NET WORTH
About Us Contact Us Privacy Policy Terms of Use DMCA Opt-out of personalized ads
© Copyright 2023 Market Realist. Market Realist is a registered trademark. All Rights Reserved. People may receive compensation for some links to products and services on this website. Offers may be subject to change without notice.
MARKETREALIST.COM / ECONOMY & WORK

New Information Stealer Malware 'TimbreStealer' Is Targeting Mexican Users: Report

They lure victims to download a new obfuscated information stealer that the company is calling "TimbreStealer".
PUBLISHED MAR 1, 2024
Cover Image Source: Hacker on Laptop | Sora Shimazak | Pexels
Cover Image Source: Hacker on Laptop | Sora Shimazak | Pexels

An information stealer malware has emerged to be one of the biggest threats recently. This malware has been proven dangerous for organizations and individuals alike. 

Cisco Talos, an Intelligence Group, discovered a new campaign operated by a threat actor distributing a previously unknown malware called "TimbreStealer." The group describes the authors as skilled and that the "threat actor has previously used similar tactics, techniques, and procedures (TTPs)" to pull off a banking fraud known as Mispadu in September 2023, as per the report.

The phishing campaign is pretty advanced and can employ sophisticated techniques that sidestep detection and ensure persistence. This particular phishing campaign makes use of geofencing to target users in Mexico, as mentioned in the report.



 

They lure the victims to download a new obfuscated information stealer that the company is calling "TimbreStealer". They also use phishing emails with financial schemes directing the people to a shady website where the payload is hosted. Some of the evasive techniques used include leveraging custom loaders and system calls to bypass the main API monitoring. They also use Heaven's Gate to execute 64-bit code within a 32-bit process which is a pretty well-known approach.

Talos also saw other distribution campaigns that have been conducted by this actor since 2023. The current spam run mainly used Mexico's digital tax receipt standard called CDFI. This malware has many embedded modules for decryption and protection of the main binary as well as orchestration. The malware can also run a series of checks to determine if it's running a sandbox environment. It was also seen that the orchestrator module took files and registry keys to double-check that the machine hadn't been previously attacked before it finally launched a payload installer that displayed a file to the user and then triggered the execution of TimbreStealer's primary payload.

Getty Images | Photo by Manuel Medir
Getty Images | Photo by Manuel Medir

This payload is specifically designed to get a range of data starting from credential information to system metadata and more. The payload is also capable of looking for files that match the specific extension and verifying the presence of remote desktop software. 

The orchestrator has four other encrypted sub-modules within it. "Each stripped DLL is loaded by a custom shellcode loader from submodule #0 (IDX = 0). Execution is transferred to this shellcode through a Heaven’s Gate stub using the ZwCreateThreadEx API," the analysis reads.

TimbreStealer is also capable of collecting OS information, and it does that by using the Windows Management Instrumentation interface and registry keys. Here's the report, if you want to know more about the malware, like indicators of compromise and other capabilities. 



 

The revelation comes after the new version of another information stealer called Atomic emerged a few months back. Atomic, which is also called AMOS, can gather data from Apple macOS systems. Information like credentials from Mozilla Firefox and Chromium-based browsers, crypto wallet information as well as other account passwords can be compromised.

"The new variant drops and uses a Python script to stay covert," Bitdefender researcher Andrei Lapusneanu said about Atomic. According to an IBM X-Force report, info stealer-related malware has increased by 266% in 2023 and the number is set to rise in 2024.

"These challenges are why organizations must enforce multi-factor authentication for all accounts, strengthen their IAM systems, and stress-test their environments," the report reads.

MORE ON MARKET REALIST
The man from New Jersey bagged the reward when he was in the studio just as a member of the audience.
3 hours ago
Viewers were left scrambling for an explanation until the glitch was fixed during a re-run later that year.
5 hours ago
The person who originally listed the property later explained the logic behind the design.
8 hours ago
Later, she finally found a way to get rid of the Tahoe after three years of paying $1,400 a month.
19 hours ago
A study highlighted the alarming number of bacteria found on a large package from Amazon.
1 day ago
So far the recall hasn't been directly linked to the salmonella outbreak caused by eggs from another brand.
1 day ago
The employer was overwhelmed after learning about the struggles of his employees.
1 day ago
The video gained so much popularity that some users even advised Amazon that it could be their next commercial.
1 day ago
The transit worker and her husband still haven't decided what they intend to do with the winnings.
2 days ago
Vanna White herself feels that Maggie Sajak has her father's charm and can be a fitting replacement for her.
2 days ago
Markle had even shared that she wasn't fond of her stint as the "Briefcase Girl" on the show.
3 days ago
The photographer also charged extra to edit the pictures although he too had missed the flaw.
4 days ago
The woman revealed that her aunt received the artwork as a gift to thank her for a pillow.
4 days ago
At the peak of his career, Jones reportedly made over $7 million in one season of "Two and a Half Men"
5 days ago
While it's not clear if Jay-Z was describing a hypothetical situation or a real one, the clip gained enough traction.
5 days ago
The content creator also started a GoFundMe page for the cashier to raise more money to reward her.
7 days ago
The celebrity wanted to help women in the criminal justice system who face unique challenges.
Nov 27, 2024
The rapper says people can find all the wisdom in his music.
Nov 27, 2024
The man, who bagged over $180,000 due to an HR error, was told to return the money, but he had other plans.
Nov 25, 2024
Before he joined 'The Price is Right' Carey also played a fictionalized version of himself in a show.
Nov 24, 2024