lockscreenMalware
Last reported 2 months ago, by Check Point Research3 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1037Boot or Logon Initialization Scripts
“Boot or Logon Initialization Scripts”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1056.002GUI Input Capture
“Malicious Third Party Keyboard App: GUI Input Capture”
- T1059.005Visual Basic
“After installing a Visual Basic 6 editor, the following GUI window appears in the form editor.”
- T1505.003Web Shell
“wp-cssv.php is a Secure File Manager, which is a single-file web shell with upload and delete capability.”
- T1674Input Injection
“Input Injection”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect“…ell script 1 → PowerShell script 2 → stage 1 (loader) → stage 2 (downloader & loader) → stage 3 ( components: encryptor, SMB/USB worm, lockscreen, credential stealer, VBS spreader, chat utility )”
-
PromptSpy ushers in the era of Android threats using GenAI“This Android malware also abuses the Accessibility Service to block uninstallation with invisible overlays, captures lockscreen data, records video.”
-
Gustuff: Weapon of Mass Infection“"lockType":<%Type of lockscreen password%>”
Indicators in its reports
named in the reports above- websitesmaximumrock[.]roin 1 report
- platinumcar[.]cain 1 report
- norakremer.co[.]ukin 1 report
- pharmart[.]aein 1 report
- ksr-racingparts[.]comin 1 report
- websitesv-k.com[.]uain 1 report
- www.parsrulman[.]comin 1 report
- mectcalcutta[.]comin 1 report
- discherniation[.]comin 1 report
- 8337bf29100a5871…4fd78af59ac5in 1 report
- 4dee2fe98d4da75f…8068eddea504in 1 report
- 7d3604d0728b242c…507c701df20cin 1 report
- 976cfa57e1efacbe…e3a966aaa153in 1 report
- 65550f6d0ffec842…4a18afe72143in 1 report
- 0080d0dd72eda485…ceee75972b40in 1 report
- 10babb15e08f9fbd…f4d9c8e372c0in 1 report
- f042240c3de00c46…091409766e41in 1 report
- 2adbb2c206be7f23…1a6eaa42c68cin 1 report
- 38602b76f6c65644…dc7212324ab9in 1 report
- 3ba161ca7b8dcf38…49cad46132a8in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.