FIN8 hacker group uses new White Rabbit malware

Trend Micro experts studied a sample of the new White Rabbit malware obtained during an investigation of an attack on a US bank in December 2021. Apparently, this malware may be a part of a side operation of the FIN8 hacker group.

FIN8 has been active since at least January 2016 and is known for attacking retail, restaurants, hospitality, and healthcare to steal payment card data from POS systems. Over the years, researchers have observed a variety of tools and tactics in FIN8’s arsenal, ranging from various POS malware, including BadHatch, PoSlurp (PunchTrack), PowerSniff (PunchBuggy, ShellTea), aan zero-day vulnerabilities en targeted phishing.

The executable file of the new malware is a small 100 kb payload. It requires a password to be entered to decrypt the malicious payload. It is noteworthy that the same password was previously used in the work of other ransomware, including Egregor, MegaCortex en SamSam.

Once launched with the correct password, the ransomware scans all folders on the device and encrypts the target files, creating a ransom note for each encrypted file. The note informs the victim that their files were stolen and encrypted, and the attackers threaten to publish or sell the stolen data if their demands are not met.

Evidence of file theft is uploaded to services such as paste[.]com and file[.]io, and victims are encouraged to contact the hackers through a special site on the dark web.

Experts note that evidence of a connection between FIN8 and White Rabbit is discovered even at the stage of ransomware deployment. Dus, the malware uses a new and previously unknown version of the Badhatch backdoor (also known as Sardonic) associated with FIN8.

Although the White Rabbit attacks have only recently attracted the attention of experts and have managed to affect only a few organizations, it seems that hacker activity began as early as July 2021.

You might also be interested to know what Linux wanware, CronRAT, skuil in 'n cron job met verkeerde datums, and what Nuut MasterFred malware targets Netflix, Instagram en Twitter users.