The Adwind jRAT, a remote access Trojan known for targeting login credentials and other data, is adopting new tactics as its operators aim to better conceal malicious activity. Its actors exploit common Java functionality to steal information while evading defensive security tools.
Adwind, related to AlienSpy and also known as Frutas, Unrecom, Sockrat, and JSocket, is a known cross-platform RAT that has been targeting businesses since 2013. It's capable of stealing credentials, system information, and cryptographic keys, as well as keylogging, taking screenshots, and transferring files. This jRAT typically uses phishing emails, infected software, or malicious websites to target a range of platforms including Windows, Linux, and macOS.
A new variant is focused on Windows machines and common Windows applications Explorer and Outlook, report researchers at Menlo Security who detected it about four months ago. Adwind is now going after Chromium-based browsers, including newer browsers such as Brave. Menlo security researcher Krishnan Subramanian says the pivot to Windows was a logical move for Adwind's operators: While the jRAT was platform-agnostic, most of its victims ran Windows.
The latest jRAT variant uses Java to take control over and collect data from a victim's machine. It's specifically after login credentials, says Subramanian, who notes this particular variant has been actively targeting industries like financial services, where login credentials are valuable.
This malware arrives in a JAR file concealed in a link inside a phishing email or downloaded from a legitimate site serving up unsecured third-party content. Researchers ..
Support the originator by clicking the read the rest link below.
