Nim-Based Malware Delivered via Phishing Campaign Using Decoy Microsoft Word Documents

December 22, 2023

A new phishing campaign is exploiting the unfamiliarity of the security community with the Nim programming language to deliver a backdoor. Netskope researchers Ghanashyam Satpathy and Jan Michael Alcantara highlighted the challenge posed by malware written in less common languages.

The campaign involves a phishing email with a Word document attachment that encourages the recipient to enable macros, which in turn activates the Nim malware. The sender impersonates a Nepali government official.

Once the malware is activated, it scans for known analysis tools on the infected host. If it detects any, it terminates itself. If not, it establishes connections with a remote server that mimics a government domain from Nepal.

The article also discusses a social engineering campaign uncovered by Cyble that uses messages on social media platforms to deliver a Python-based stealer malware, Editbot Stealer. This malware is designed to harvest and exfiltrate valuable data via a Telegram channel controlled by the actor.

The article goes on to mention known malwares like DarkGate and NetSupport RAT being distributed through phishing campaigns. DarkGate is designed to steal information and download additional malware payloads, while NetSupport RAT, originally a legitimate remote administration tool, has evolved into a powerful tool for malicious actors to infiltrate systems and establish remote control.

The article also mentions an attack sequence identified in early October 2023 that chained two traffic delivery systems (TDSs) – 404 TDS and Keitaro TDS – to filter and redirect victims to an actor-operated domain hosting a payload that exploited CVE-2023-36025, a high-severity Windows SmartScreen security bypass that was patched by Microsoft in November 2023. This suggests that the BattleRoyal cluster weaponized this vulnerability as a zero-day a month before it was publicly revealed.

Related News

• Public Release of PoC Exploit for Critical Windows Defender Bypass
• Windows Zero-Day CVE-2023-36025 Vulnerability: PoC Exploit Published by Researchers
• Microsoft's November 2023 Patch Tuesday Addresses 58 Flaws Including 5 Zero-Days

Latest News

• Multiple Zero-Day Vulnerabilities Exploited in Windows CLFS Driver
• Google Patches 8th Chrome Zero-Day Exploited in 2023
• Ivanti Patches 13 Critical Security Flaws in Avalanche Enterprise Mobile Device Management Solution
• Cyber Attackers Utilize Old Microsoft Office Vulnerability to Disseminate Spyware
• Critical Vulnerability in WordPress Plugin WP Clone Exposes 90,000 Sites to Potential Cyberattacks