SatacomMalware
- curlygate
- LegionLoader
- robotdropper
Last reported 4 days ago, by Help Net Security5 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1684Social Engineering
“Social engineering”
- T1055Process Injection
“Execution from disk, use of an internal PE loader, process injection, “RuntimeBroker.Exe” process hollowing”
- T1055.012Process Hollowing
“Execution from disk, use of an internal PE loader, process injection, “RuntimeBroker.Exe” process hollowing”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign“One of the payloads they analyzed, LegionLoader, can collect sensitive information stored in victims’ Chrome browsers.”
-
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware“Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware”
-
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks“Forescout saw the platform deliver the LegionLoader malware, as well as a trojanized installer that leveraged a legitimate Stardock application for DLL side-loading.”
-
ROMULUS Malware Server Leverages ClickFix to Deliver Multiple Payloads“One delivery route was observed to distribute LegionLoader, a multi-pronged malware delivery platform, through encrypted archives containing an executable artificially inflated to approximately 842 MiB, potentially exceeding file-size limits imposed by security scanning and analy…”
-
I just trusted the security certificate prompt… Beware of the LegionLoader malware being distributed via the ClickFix method“I just trusted the security certificate prompt… Beware of the LegionLoader malware being distributed via the ClickFix method”
Indicators in its reports
named in the reports above- 2.27.248[.]127in 2 reports
- ascendpopdownloadtoday[.]monsterin 1 report
- 89.34.90[.]217in 1 report
- socialseoguru[.]comin 1 report
- gemscocl[.]comin 1 report
- leappoploaderinstantly[.]monsterin 1 report
- gushpopsecretdownload[.]monsterin 1 report
- jetpopdownloadsecret[.]monsterin 1 report
- pourpopclickgetfast[.]monsterin 1 report
- spoutpoploaderfast[.]monsterin 1 report
- hotfootpopfilefast[.]monsterin 1 report
- boltpopsecretbutton[.]monsterin 1 report
- tearpopfilegetfast[.]monsterin 1 report
- flinchpoploaderfast[.]monsterin 1 report
- pixelrainbowclub[.]cfdin 1 report
- dreamysamuraisoul[.]cfdin 1 report
- animecelestialblaze[.]cfdin 1 report
- cartoontalesworld[.]cfdin 1 report
- shadowinjalegend[.]cfdin 1 report
- hxxp://dallasbackstage[.]com/nfront.Phpin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.