Study workers Discover Microsoft-Signed FiveSys Rootkit in the Wild – Usually the Hacker News

A newly identified rootkit has been found with a valid digital signature issued by Microsoft that’s used to proxy traffic to internet addresses of interest to the attackers for over a year targeting online gamers in China.

Bucharest-headquartered cybersecurity technology company Bitdefender named the malware ” FiveSys ,” calling out its possible credential theft and in-game-purchase hijacking motives. The Windows maker has since revoked the signature following responsible disclosure.

“Digital signatures are a way of establishing trust,” Bitdefender researchers said in a white paper, adding “a valid digital signature helps the attacker navigate around the operating system’s restrictions on loading third-party modules into the kernel. Once loaded, the rootkit allows its creators to gain virtually unlimited privileges.”

Rootkits are both evasive and stealthy as they offer threat actors an entrenched foothold onto victims’ systems and conceal their malicious actions from the operating system (OS) as well as from anti-malware solutions, enabling the adversaries to maintain extended persistence even after OS reinstallation or replacement of the hard drive.

In the case of FiveSys, the malware’s main objective is to route and route internet traffic because both HTTP and HTTPS connections to malicious domain names under the attacker’s control by using a custom proxy server. Some of the rootkit operators also employ generally the practice of blocking their loading of drivers with competing groups using a unique blocklist of stolen certificates to prevent them from coping with the machine.

“To make expected takedown attempts more difficult, finally the rootkit comes with a built-in detail outline of 300 domains on the ‘. xyz’ [top-level domain], inch the researchers noted. “They seem to be generated randomly or stored in an encrypted technique inside the binary. ”

The development marks the next time wherein malicious device drivers with valid digital autographs issued by Microsoft through your Windows Hardware Quality System ( WHQL ) signing process display slipped through the cracks. In late June 2021, German cybersecurity small business} G Data disclosed information on another rootkit dubbed type Netfilter inch (and tracked by Msft as “Retliften”), which, shares FiveSys, also aimed at avid gamers in China.

Source of this news: https://thehackernews.com/2021/10/researchers-discover-microsoft-signed.html