Quasar RAT, an open-source remote access trojan, is leveraging DLL side-loading to infiltrate Windows hosts and steal data. The attack begins with an ISO image file, which contains malicious code that is hidden through DLL side-loading. A ‘FileDownloader.exe’ file is injected into the Windows Assembly Registration Tool, which triggers the trojan to establish connections with a remote server and send system information. The likely dissemination method is phishing emails.
Lazarus Hackers Exploiting IIS Servers to Deploy ASP-based Web Shells
The Lazarus group has launched sophisticated attacks on South Korean web servers, deploying ASP-based web shells as first-stage Command and Control (C2) servers. These attacks,
