Malware Campaign Hides Ransomware in Super Mario Wrapper
A newly discovered malware campaign uses steganography to hide GandCrab in a seemingly innocent Mario image.
In the Mario Brothers universe, Mario is a hero, but that "good guy" status doesn't extend to the real world — at least not for victims of a malware campaign that wraps the GandCrab ransomware in a Mario graphic package.
Matthew Rowan, a researcher at Bromium, discovered the campaign in a malware sample he was analyzing. In his blog post detailing the discovery, he shows how threat actors hide their true intentions, why it's a very bad idea to disable software protection mechanisms, and why old encryption techniques like steganography are still useful in the modern era.
The steganography comes into play with heavily obfuscated Microsoft PowerShell commands hidden within the color channels of a picture of Mario in a particularly cool pose. Rowan notes that hiding commands in the image makes it very difficult for a firewall to pick up the threat and apply a standard filter against the malware.
The new campaign is a threat to computer users in Italy, though, like most such campaigns, it could easily be modified by a different criminal to target users in any (or every) geography.
Read more here.
About the Author
You May Also Like
Transform Your Security Operations And Move Beyond Legacy SIEM
Nov 6, 2024Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024