DeathStalker APT Targets SMBs with Cyber Espionage
The hacker-for-hire group, operating since at least 2012, primarily targets financial firms.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Small and midsize businesses (SMBs) should have a new advanced persistent threat (APT) on their collective radar: DeathStalker has been targeting SMBs in the financial sector since at least 2012.
Kaspersky researchers tracking the group since 2018 report DeathStalker has targeted companies around the world. Attackers don't seem motivated by financial gain; they don't deploy ransomware or steal payment data. The focus is sensitive business data, which could mean DeathStalker offers hacker-for-hire services, or serves as a sort of "information broker," in financial circles, they write in a new analysis.
The group caught researchers' attention with Powersing, a PowerShell-based implant. This is one of three malware families tied to DeathStalker's activity and the one researchers have used to track the group since 2018. The other two malware families, Evilnum and Janicab, were first reported by other security vendors. Code similarities and victimology among the three families enabled researchers to connect them to each other "with medium confidence," they report.
DeathStalker uses tailored spear-phishing emails to deliver archives containing malicious files. When a victim executes the script, it downloads more components from the Internet to give attackers control over the machine. When Powersing lands on a device, it can take screenshots and execute PowerShell scripts. Depending on the security solution, it can also evade detection.
Victim companies are primarily private entities in the financial space, including law offices, wealth consultancy firms, financial technology companies, and similar organizations. In one case, the group was seen targeting a diplomatic entity. It's believed DeathStalker chooses its victims based on perceived value or based on customer requests, though research believe any financial firm, regardless of location, could be at risk.
Read more details here.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024