{"id":44941,"date":"2023-11-01T15:23:23","date_gmt":"2023-11-01T12:23:23","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=44941"},"modified":"2026-03-28T04:26:03","modified_gmt":"2026-03-28T01:26:03","slug":"worldwide-multi-malware-campaign-targets-organizations-using-backdoor-keylogger-and-miner","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/worldwide-multi-malware-campaign-targets-organizations-using-backdoor-keylogger-and-miner\/","title":{"rendered":"Worldwide \u201cmulti-malware\u201d campaign targets organizations using backdoor, keylogger, and miner\u00a0"},"content":{"rendered":"\n

The latest Kaspersky report revealed that an ongoing malicious \u201cmulti-malware\u201d campaign has conducted more than 10,000 attacks primarily targeting global organizations. The campaign employs backdoors, keyloggers, and miners. Using new malicious scripts designed to disable security features and facilitate malware downloads, its aim is financial exploitation.\u00a0<\/strong><\/p>\n\n\n\n

Following an FBI report<\/a> on the attacks \u2013 aimed at infecting victim organizations with miners to use its resources for mining, keyloggers to pilfer data, and backdoors to gain system access \u2013 Kaspersky experts have been tracking the campaign and discovered that it is still ongoing. <\/p>\n\n\n\n

Primarily targeting organizations including government agencies, agricultural organizations, and wholesale and retail trade companies from May to October, Kaspersky\u2019s telemetry shows more than 10,000 attacks have affected more than 200 users. Cybercriminals predominantly targeted victims in Russia, Saudi Arabia, Vietnam, Brazil, and Romania, with occasional attacks also identified in the U.S., India, Morocco, and Greece. <\/p>\n\n\n\n

Kaspersky has also exposed new malicious scripts that appear to infiltrate systems by exploiting vulnerabilities on servers and workstations. Once inside, the scripts try to manipulate Windows Defender, gain administrator privileges, and disrupt the functionality of various antivirus products. <\/p>\n\n\n\n

Following this, the scripts then attempt to download a backdoor, keylogger, and miner from a now-offline website. The miner leverages the system\u2019s resources to generate various cryptocurrencies such as Monero (XMR). Meanwhile, the keylogger captures the entire sequence of keystrokes made by the user on the keyboard and mouse buttons, while the backdoor establishes communication with a Command and Control (C2) server to receive and transmit data. This enables the attacker to gain remote control over the compromised system. <\/p>\n\n\n\n

\u201cThis multi-malware campaign is rapidly evolving with the introduction of new modifications. The attackers\u2019 motivation appears to be rooted in the pursuit of financial gain by any means possible. Our expert research suggests this could extend beyond cryptocurrency mining and may involve activities such as selling stolen login credentials on the dark web or executing advanced scenarios using the backdoor\u2019s capabilities,<\/em>\u201d says Vasily Kolesnikov, a security expert at Kaspersky. \u201cOur products, such as Kaspersky Endpoint Security, can detect the infection attempts, including those made with the new modifications, thanks to their extensive protective capabilities<\/em>.\u201d<\/p>\n\n\n\n

The technical analysis of the campaign is available on the Securelist.com<\/a>. To avoid ever evolving cyberthreats, it is worth implementing the following security measures: <\/p>\n\n\n\n