New Cyberattack Campaign Utilizes MSIX Windows App Package Files to Distribute GHOSTPULSE Malware Loader

In the ever-evolving landscape of cyber threats, a new attack campaign has emerged, leveraging spurious MSIX Windows app package files. This sophisticated campaign targets popular software applications like Google Chrome, Microsoft Edge, Brave, Grammarly, and Cisco Webex to distribute a novel malware loader called GHOSTPULSE. The attackers behind this campaign employ various techniques to entice users into downloading the MSIX packages, including compromised websites, search engine optimization (SEO) poisoning, and malvertising.

Understanding MSIX

MSIX is a Windows app package format that developers can utilize to package, distribute, and install their applications for Windows users. It offers several advantages, such as streamlined updates and improved security. However, the usage of MSIX requires access to code signing certificates, which are either acquired legitimately or stolen. These certificates bestow authenticity upon the app packages but also make the attackers’ task more complex, as they need above-average resources to obtain or compromise such certificates.

Accessing MSIX files

The reliance on code signing certificates introduces an additional layer of difficulty for attackers. Acquiring or stealing these certificates requires significant resources and expertise, making them more attractive to groups with above-average capabilities. By leveraging these certificates, the attackers can potentially bypass security measures that rely on the authenticity and trustworthiness of signed app packages.

Distribution techniques

To ensure the successful dissemination of their malicious payload, the attackers employ a range of distribution techniques. Compromised websites, often through vulnerabilities or maliciously injected code, serve as platforms to host the spurious MSIX packages. Additionally, these attackers employ search engine optimization (SEO) poisoning techniques to manipulate search engine rankings and redirect unsuspecting users to their malicious pages. The use of malvertising, wherein malicious ads are spread across legitimate websites, is yet another avenue exploited by these threat actors.

Execution of GHOSTPULSE

Once a user unwittingly launches the fraudulent MSIX file, a Windows prompt appears, urging the user to click the “Install” button. Unfortunately, by doing so, the user unknowingly initiates the stealthy download of GHOSTPULSE onto their compromised host. The malware is retrieved from a remote server, specifically “manojsinghnegi[.]com,” using a PowerShell script to execute the download process.

Multiple stages of payload

The attack campaign incorporates a multi-stage payload delivery strategy to avoid detection and increase the chances of successful infiltration. The initial payload is a TAR archive file containing an executable that masquerades as the Oracle VM VirtualBox service, VBoxSVC.exe. However, under the camouflage, the executable is a legitimate binary from Notepad++ (gup.exe).

Execution of malicious DLL

Upon execution, the PowerShell script triggers the binary VBoxSVC.exe, which then proceeds to side-load the malicious DLL libcurl.dll from the current directory. By taking this approach, the threat actor minimizes the on-disk footprint of the encrypted malicious code, making it more difficult for file-based antivirus and machine learning scanning systems to detect and block the payload.

Tampered DLL and payload

The tampered DLL, libcurl.dll, processes the handoff.wav file. This file serves as the carrier for an encrypted payload that is subsequently decrypted. To execute the payload, the attackers employ a technique known as module stomping. This involves the manipulation of the mshtml.dll module to load and execute GHOSTPULSE, completing the malware’s initial deployment and activation.

Loading GHOSTPULSE

GHOSTPULSE functions as a loader, and its primary role is to facilitate the execution and deployment of an array of sophisticated malware. In this campaign, the attackers utilize a technique known as process doppelganging to kick-start the execution of the final payload. This technique involves creating a new process that mimics a legitimate process, evading detection by security systems.

Final version

Once GHOSTPULSE has successfully executed the process doppelgänging technique, it initiates the execution of various malware strains. These include SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport RAT. Each of these malware variants possesses unique capabilities and presents further risks to the compromised host, including information theft, surveillance, and remote control.

The rise of cyberattack campaigns utilizing MSIX Windows app package files highlights the increasing need for vigilance and robust security measures. These sophisticated attacks targeting popular software applications demonstrate the ingenuity and resourcefulness of threat actors. As organizations and individuals navigate the digital landscape, it is crucial to stay informed, exercise caution when installing software or downloading files, and maintain up-to-date security measures to mitigate the risk of falling victim to such campaigns.

Explore more

Employee Engagement Crisis: How to Restore Workplace Happiness

We’re thrilled to sit down with Ling-Yi Tsai, a renowned HRTech expert with decades of experience helping organizations navigate change through innovative technology. With a deep focus on HR analytics and the seamless integration of tech in recruitment, onboarding, and talent management, Ling-Yi offers invaluable insights into the pressing challenges of employee engagement and workplace well-being. In this conversation, we

How Is AI Transforming Digital Marketing Strategies?

Artificial Intelligence (AI) is rapidly becoming a cornerstone of digital marketing, fundamentally altering how brands connect with audiences in an increasingly crowded online space. As businesses grapple with the challenge of capturing consumer attention amidst endless streams of content, AI offers a lifeline by providing tools that personalize experiences, streamline operations, and deliver data-driven insights. This technological shift is not

Business Central Mobile Apps Transform Operations On-the-Go

In an era where business agility defines success, the ability to manage operations from any location has become a critical advantage for companies striving to stay ahead of the curve, and Microsoft Dynamics 365 Business Central mobile apps are at the forefront of this shift. These apps redefine how organizations handle essential tasks like finance, sales, and inventory management by

Transparency Key to Solving D365 Pricing Challenges

Understanding the Dynamics 365 Landscape Imagine a business world where operational efficiency hinges on a single, powerful tool, yet many enterprises struggle to harness its full potential due to unforeseen hurdles. Microsoft Dynamics 365 (D365), a leading enterprise resource planning (ERP) and customer relationship management (CRM) solution, stands as a cornerstone for medium to large organizations aiming to integrate and

Generative AI Transforms Finance with Automation and Strategy

This how-to guide aims to equip finance professionals, particularly chief financial officers (CFOs) and their teams, with actionable insights on leveraging generative AI to revolutionize their operations. By following the steps outlined, readers will learn how to automate routine tasks, enhance strategic decision-making, and position their organizations for competitive advantage in a rapidly evolving industry. The purpose of this guide