New Cyberattack Campaign Utilizes MSIX Windows App Package Files to Distribute GHOSTPULSE Malware Loader

In the ever-evolving landscape of cyber threats, a new attack campaign has emerged, leveraging spurious MSIX Windows app package files. This sophisticated campaign targets popular software applications like Google Chrome, Microsoft Edge, Brave, Grammarly, and Cisco Webex to distribute a novel malware loader called GHOSTPULSE. The attackers behind this campaign employ various techniques to entice users into downloading the MSIX packages, including compromised websites, search engine optimization (SEO) poisoning, and malvertising.

Understanding MSIX

MSIX is a Windows app package format that developers can utilize to package, distribute, and install their applications for Windows users. It offers several advantages, such as streamlined updates and improved security. However, the usage of MSIX requires access to code signing certificates, which are either acquired legitimately or stolen. These certificates bestow authenticity upon the app packages but also make the attackers’ task more complex, as they need above-average resources to obtain or compromise such certificates.

Accessing MSIX files

The reliance on code signing certificates introduces an additional layer of difficulty for attackers. Acquiring or stealing these certificates requires significant resources and expertise, making them more attractive to groups with above-average capabilities. By leveraging these certificates, the attackers can potentially bypass security measures that rely on the authenticity and trustworthiness of signed app packages.

Distribution techniques

To ensure the successful dissemination of their malicious payload, the attackers employ a range of distribution techniques. Compromised websites, often through vulnerabilities or maliciously injected code, serve as platforms to host the spurious MSIX packages. Additionally, these attackers employ search engine optimization (SEO) poisoning techniques to manipulate search engine rankings and redirect unsuspecting users to their malicious pages. The use of malvertising, wherein malicious ads are spread across legitimate websites, is yet another avenue exploited by these threat actors.

Execution of GHOSTPULSE

Once a user unwittingly launches the fraudulent MSIX file, a Windows prompt appears, urging the user to click the “Install” button. Unfortunately, by doing so, the user unknowingly initiates the stealthy download of GHOSTPULSE onto their compromised host. The malware is retrieved from a remote server, specifically “manojsinghnegi[.]com,” using a PowerShell script to execute the download process.

Multiple stages of payload

The attack campaign incorporates a multi-stage payload delivery strategy to avoid detection and increase the chances of successful infiltration. The initial payload is a TAR archive file containing an executable that masquerades as the Oracle VM VirtualBox service, VBoxSVC.exe. However, under the camouflage, the executable is a legitimate binary from Notepad++ (gup.exe).

Execution of malicious DLL

Upon execution, the PowerShell script triggers the binary VBoxSVC.exe, which then proceeds to side-load the malicious DLL libcurl.dll from the current directory. By taking this approach, the threat actor minimizes the on-disk footprint of the encrypted malicious code, making it more difficult for file-based antivirus and machine learning scanning systems to detect and block the payload.

Tampered DLL and payload

The tampered DLL, libcurl.dll, processes the handoff.wav file. This file serves as the carrier for an encrypted payload that is subsequently decrypted. To execute the payload, the attackers employ a technique known as module stomping. This involves the manipulation of the mshtml.dll module to load and execute GHOSTPULSE, completing the malware’s initial deployment and activation.

Loading GHOSTPULSE

GHOSTPULSE functions as a loader, and its primary role is to facilitate the execution and deployment of an array of sophisticated malware. In this campaign, the attackers utilize a technique known as process doppelganging to kick-start the execution of the final payload. This technique involves creating a new process that mimics a legitimate process, evading detection by security systems.

Final version

Once GHOSTPULSE has successfully executed the process doppelgänging technique, it initiates the execution of various malware strains. These include SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport RAT. Each of these malware variants possesses unique capabilities and presents further risks to the compromised host, including information theft, surveillance, and remote control.

The rise of cyberattack campaigns utilizing MSIX Windows app package files highlights the increasing need for vigilance and robust security measures. These sophisticated attacks targeting popular software applications demonstrate the ingenuity and resourcefulness of threat actors. As organizations and individuals navigate the digital landscape, it is crucial to stay informed, exercise caution when installing software or downloading files, and maintain up-to-date security measures to mitigate the risk of falling victim to such campaigns.

Explore more

Agency Management Software – Review

Setting the Stage for Modern Agency Challenges Imagine a bustling marketing agency juggling dozens of client campaigns, each with tight deadlines, intricate multi-channel strategies, and high expectations for measurable results. In today’s fast-paced digital landscape, marketing teams face mounting pressure to deliver flawless execution while maintaining profitability and client satisfaction. A staggering number of agencies report inefficiencies due to fragmented

Edge AI Decentralization – Review

Imagine a world where sensitive data, such as a patient’s medical records, never leaves the hospital’s local systems, yet still benefits from cutting-edge artificial intelligence analysis, making privacy and efficiency a reality. This scenario is no longer a distant dream but a tangible reality thanks to Edge AI decentralization. As data privacy concerns mount and the demand for real-time processing

SparkyLinux 8.0: A Lightweight Alternative to Windows 11

This how-to guide aims to help users transition from Windows 10 to SparkyLinux 8.0, a lightweight and versatile operating system, as an alternative to upgrading to Windows 11. With Windows 10 reaching its end of support, many are left searching for secure and efficient solutions that don’t demand high-end hardware or force unwanted design changes. This guide provides step-by-step instructions

Mastering Vendor Relationships for Network Managers

Imagine a network manager facing a critical system outage at midnight, with an entire organization’s operations hanging in the balance, only to find that the vendor on call is unresponsive or unprepared. This scenario underscores the vital importance of strong vendor relationships in network management, where the right partnership can mean the difference between swift resolution and prolonged downtime. Vendors

Immigration Crackdowns Disrupt IT Talent Management

What happens when the engine of America’s tech dominance—its access to global IT talent—grinds to a halt under the weight of stringent immigration policies? Picture a Silicon Valley startup, on the brink of a groundbreaking AI launch, suddenly unable to hire the data scientist who holds the key to its success because of a visa denial. This scenario is no