Overview
Threat actors have launched sophisticated campaigns utilizing image steganography techniques to deliver multiple malware variants through archive.org hosting. The attacks leverage CVE-2017-11882 and employ Base64 encoding with .NET loaders
Whom it may concern
- IT Security Teams
- Network Administrators
- Security Operations Centers
- Incident Response Teams
Key Findings
- Two distinct malware campaigns targeting enterprise systems
- Complex multi-stage attack chain using PowerShell and .NET
- Exploitation of legitimate file hosting on archive.org
- GenAI involvement in HTML smuggling techniques
Risk Analysis
- Probability: High due to automated deployment
- Impact: Severe - potential data theft includes:
- Keystrokes
- Clipboard content
- Screenshots
- Credentials
- Attack Sophistication: Medium-High
- Detection Difficulty: High due to legitimate hosting
Action Items
- Implement email attachment scanning
- Deploy PowerShell logging and monitoring
- Update patch management for CVE-2017-11882
- Enable network traffic analysis for archive.org connections
- Deploy endpoint detection focusing on steganography
Sources
- [The Hacker News](https://thehackernews.com/2025/01/hackers-hide-malware-in-images-to.html)
- HP Wolf Security Q3 2024 Threat Insights Report
