Security researchers have spotted a new variant of the Sazoora data-theft Trojan employing nifty tricks to avoid security sandboxes.
According to Seculert CTO Aviv Raff, the malware has been fitted with packing and technical changes aimed at defeating on-premises sandboxes.
“Instead of immediately launching like [the first version of the Trojan], Sazoora.B waits for 15 minutes before becoming active. This dormant phase makes it undetectable,” Raff warned in a blog post.
Another significant difference between the two malware variants is the fact that Sazoora.B sends a message to its command and control server (C&C) before it begins sending its stolen data. Raff said the malware requires the C&C to authenticate itself via a signed signature. “This verifies that the C&C is owned by the attackers, preventing other cybercriminals from hijacking their botnet,” he explained.
Over the last month, Seculert has tracked ore than 23,000 of infections of this new malware in Austria, Switzerland, Belgium, and the United States.
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Microsoft Catches Chinese .Gov Hackers Targeting US Critical Infrastructure
- Researchers Spot APTs Targeting Small Business MSPs
- Mikrotik Belatedly Patches RouterOS Flaw Exploited at Pwn2Own
- Red Hat Pushes New Tools to Secure Software Supply Chain
- Investors Make $6M Bet on Manifest for SBOM Management Technology
- Entro Raises $6M to Tackle Secrets Sprawl
- IBM Snaps up DSPM Startup Polar Security
- Huntress Closes $60M Series C for MDR Expansion
Latest News
- Chrome 114 Released With 18 Security Fixes
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Breaking Enterprise Silos and Improving Protection
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- PyPI Enforcing 2FA for All Project Maintainers to Boost Security
- Personal Information of 9 Million Individuals Stolen in MCNA Ransomware Attack
