Microsoft Tracks New BazaCall Malware Campaign

Attackers use emails to prompt victims to call a fraudulent call center, where attackers instruct them to download a malicious file.

Microsoft Security Intelligence is tracking an active BazaCall malware campaign that leads to ransomware deployment, officials reported in a Twitter thread yesterday.

The BazaCall campaigns use emails that instruct recipients to call a number to cancel their supposed subscription to a service. When victims call the number, they reach a fraudulent call center operated by attackers who tell them to visit a website and download an Excel file in order to cancel the service. This file contains a malicious macro that downloads the payload.

In this attack, Microsoft saw attackers using Cobalt Strike and report they stole credentials — including the Active Directory database — and exfiltrated data using rclone.

This campaign is named after BazaLoader (also called BazarLoader), the malware it initially distributed, company officials wrote. The malware is designed to provide backdoor access to an infected Windows device. With this level of access, attackers can send other forms of malware, scan the target environment, and go after other vulnerable machines on the same network.

The group behind BazaLoader uses different methods to distribute its malware. The method of using a call center emerged in early February 2021, said Brad Duncan, threat intelligence analyst for Palo Alto Networks’ Unit 42, in a May blog post on the threat. He noted that phone numbers in the attackers’ emails change “at least daily,” and occasionally, researchers saw more than two numbers appear in a day.

Read more details on the newest campaign in Microsoft’s Twitter thread.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Recommended Reading:

More Insights

Read More HERE