In a significant shift, cybercriminal groups behind the RedLine and Vidar infostealers have expanded their operations to include ransomware distribution. These threat actors are leveraging code-signing certificates to distribute initial payloads, allowing them to bypass email security measures. They have streamlined their techniques to serve multiple purposes, marking a concerning evolution in cyberattacks.
Researchers have discovered 30 Extended Validation (EV) code-signed samples used in a single case, highlighting the attackers‘ sophisticated methods. This development underscores the need for robust security measures, including early detection and mitigation, to counter evolving cyber threats effectively.
Furthermore, the RedLine and Vidar threat actors, known for their infostealer malware, have now adopted a double-attack vector involving ransomware. They exploit code-signing certificates to deliver their initial payloads, making it challenging to detect and prevent their attacks.
This shift in strategy emphasizes the need for enhanced cybersecurity measures to safeguard against evolving threats. Researchers have identified a concerning increase in EV code-signed samples, signaling the threat actors’ ability to manipulate code-signing certificates for malicious purposes. Effective security configurations and early threat detection are essential to thwart these versatile cybercriminals and protect against potential ransomware attacks.
Additionally, the recent attack campaign initiated with spear-phishing emails that urged users to take immediate action, often related to health and hotel accommodations. These attacks began with infostealer payloads and later escalated to ransomware delivery through cleverly disguised attachments.
The threat actors demonstrated a deep understanding of evading detection and exploiting vulnerabilities. To defend against such multifaceted threats, individuals and organizations must maintain vigilant security practices, including avoiding downloads from unverified sources and consistently updating attack surface protections.
Trend Micro’s research underscores the evolving and multifunctional nature of cyber threats, emphasizing the importance of proactive cybersecurity measures. By focusing on early detection, robust protection configurations, and user education, organizations can better safeguard against the expanding capabilities of cybercriminals who exploit code-signing certificates for their malicious purposes.
