{"id":6047,"date":"2023-10-24T05:34:04","date_gmt":"2023-10-24T05:34:04","guid":{"rendered":"\/cybersecurity-blog\/?p=6047"},"modified":"2023-12-01T07:48:11","modified_gmt":"2023-12-01T07:48:11","slug":"steganography-in-malware-attacks","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/steganography-in-malware-attacks\/","title":{"rendered":"Unpacking the Use of Steganography in Recent Malware Attacks"},"content":{"rendered":"\n

UPD:<\/strong> The section “Additional tasks” has been updated to include a new November 2023 steganography campaign.<\/p>\n\n\n\n

Malware delivery techniques are always evolving to bypass security measures. Gone are the days when a scammer could simply send an executable file as an email attachment \u2014 today, it simply won’t get past email filters.\u00a0<\/p>\n\n\n\n

Threat actors are experimenting with evasion techniques <\/h2>\n\n\n\n

To evade detection by automatic analysis tools, attackers are adding layers of complexity. We’ve seen passwords on archives, captchas, and even QR codes integrated into recent attacks \u2014 we covered them in detail in a previous article<\/a>. <\/p>\n\n\n\n

Attackers also vary the types of files they use as attachments. They opt for lnk<\/strong> files, img <\/strong>or iso <\/strong>image files, among others, to deceive security systems. Multiple techniques are often used in conjunction to increase the chances of a successful breach. <\/p>\n\n\n\n

Today, we want to highlight a resurgence in the use of steganography, a method that embeds malicious code within a benign file or image.  <\/p>\n\n\n\n

What is steganography? <\/h2>\n\n\n\n

Steganography hides data within another file or medium, effectively making it invisible. Unlike encryption, which scrambles but clearly marks data as confidential, steganography camouflages the data, blending it in with its surroundings. <\/p>\n\n\n\n

This can be used to evade security defenses. Malicious code may be embed in image files or even network traffic, aiming to make it indistinguishable from regular, benign data. This way, the hidden malware is less likely to trigger security alerts.  <\/p>\n\n\n\n

Steganography is gaining traction<\/h3>\n\n\n\n

Steganography has been around for a while, but it hasn’t been a go-to method for attackers. The main reason is that simpler payload delivery techniques have been effective enough. However, recently we’ve noticing an uptick in the use of steganography in cyber attacks. <\/p>\n\n\n\n

To better understand how this technique is being deployed, let’s walk through an example and demonstrate how to detect hidden data using ANY.RUN<\/a>.<\/p>\n\n\n

\n
\"\"
A breakdown of how this phishing campaign usually works<\/figcaption><\/figure><\/div>\n\n\n

Breaking down a steganography campaign <\/h2>\n\n\n\n

We’ll use this task<\/a> in ANY.RUN to walk through how this campaign operates. Keep in mind that attack strategies in this campaign can vary. At each stage of the attack chain, we’ll point out where the tactics might deviate from our example.<\/p>\n\n\n\n\n

\n\n

\nFollow along by creating a free account<\/span> in ANY.RUN \n<\/p>\n\n\nSign up now\u00a0\n<\/a>\n<\/div>\n\n\n\n