Cybercriminals Renting WikiLoader to Target Italian Organizations with Banking Trojan

Teilen:

Organizations in Italy are the target of a new phishing campaign that leverages a new strain of malware called WikiLoader with an ultimate aim to install a banking trojan, stealer, and spyware referred to as Ursnif (aka Gozi).

It is a sophisticated downloader with the objective of installing a second malware payload, Proofpoint said in a technical report. The malware uses multiple mechanisms to evade detection and was likely developed as a malware that can be rented out to select cybercriminal threat actors.

WikiLoader is so named due to the malware making a request to Wikipedia and checking that the response has the string The Free.

The enterprise security firm said it first detected the malware in the wild on December 27, 2022, in connection with an intrusion set mounted by a threat actor it tracks as TA544, which is also known as Bamboo Spider and Zeus Panda.

The campaigns are centered around the use of emails containing either Microsoft Excel, Microsoft OneNote, or PDF attachments that act as a lure to deploy the downloader, which is subsequently used to install Ursnif.

In a sign that WikiLoader is shared among multiple cybercrime groups, the threat actor dubbed TA551 (aka Shathak) has also been observed employing the malware as of late March 2023.

Recent TA544 campaigns detected in mid-July 2023 have utilized accounting themes to propagate PDF attachments with URLs that, when clicked, lead to the delivery of a ZIP archive file, which, in turn, packs a JavaScript file designed to download and execute WikiLoader.

WikiLoader is heavily obfuscated and comes with evasive maneuvers to bypass endpoint security software and avoid detonation in automated analysis environments. It’s also engineered to retrieve and run a shellcode payload hosted on Discord, which is ultimately used to launch Ursnif.

It is currently under active development, and its authors appear to make regular changes to try and remain undetected and fly under the radar, Selena Larson, senior threat intelligence analyst at Proofpoint, said in a statement.

It is likely more criminal threat actors will use this, especially those known as initial access brokers (IABs) that conduct regular activity that leads to ransomware. Defenders should be aware of this new malware and activities involved in payload delivery, and take steps to protect their organizations against exploitation.

 

(c) Thin

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
12:12 Uhr, Juli 7, 2025
Wetter-Symbol 17°C
L: 16° | H: 18°
aufgelockerte Bewölkung
Luftfeuchtigkeit: 71 %
Druck: 1007 mb
Wind: 10 mph WNW
Windböe: 0 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 40%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 4:52 am
Sonnenuntergang: 9:18 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
16° | 18°°C 0.99 mm 99% 13 mph 85 % 1015 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
13° | 24°°C 0.2 mm 20% 11 mph 76 % 1020 mb 0 mm/h
Mi. Juli 09 10:00 pm
Wetter-Symbol
15° | 26°°C 0 mm 0% 6 mph 66 % 1023 mb 0 mm/h
Do. Juli 10 10:00 pm
Wetter-Symbol
19° | 31°°C 0 mm 0% 8 mph 63 % 1024 mb 0 mm/h
Fr. Juli 11 10:00 pm
Wetter-Symbol
20° | 30°°C 0 mm 0% 12 mph 54 % 1023 mb 0 mm/h
Today 1:00 am
Wetter-Symbol
17° | 17°°C 0 mm 0% 9 mph 71 % 1007 mb 0 mm/h
Today 4:00 am
Wetter-Symbol
16° | 17°°C 0.31 mm 31% 8 mph 75 % 1007 mb 0 mm/h
Today 7:00 am
Wetter-Symbol
14° | 15°°C 0.99 mm 99% 10 mph 85 % 1008 mb 0 mm/h
Today 10:00 am
Wetter-Symbol
17° | 17°°C 0.33 mm 33% 12 mph 53 % 1011 mb 0 mm/h
Today 1:00 pm
Wetter-Symbol
22° | 22°°C 0 mm 0% 13 mph 37 % 1012 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
20° | 20°°C 0 mm 0% 10 mph 41 % 1013 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
20° | 20°°C 0 mm 0% 7 mph 45 % 1014 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
17° | 17°°C 0 mm 0% 11 mph 49 % 1015 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€92,664.08
0.85%
Ethereum(ETH)
€2,186.23
2.13%
Fesseln(USDT)
€0.85
0.00%
XRP(XRP)
€1.93
2.34%
Solana(SOL)
€129.01
2.70%
USDC(USDC)
€0.85
-0.01%
Dogecoin(DOGE)
€0.146265
4.68%
Shiba Inu(SHIB)
€0.000010
2.95%
Pepe(PEPE)
€0.000008
4.10%
Nach oben scrollen