☁️ OBSCURE#BAT malware uses fake CAPTCHA pages to distribute r77 rootkit and evade detection

[chushpan]

A new malware campaign has been discovered that uses social engineering tactics to distribute the open-source r77 rootkit.

🗞 Dubbed OBSCURE#BAT by Securonix, the activity allows threat actors to maintain persistence and evade detection on compromised systems. It is currently unknown who is behind the campaign.

The rootkit “has the ability to disguise any file, registry key, or task that begins with a specific prefix,” security researchers Dan Juzwik and Tim Peck wrote in a report shared with The Hacker News. “It targets users by masquerading as legitimate software downloads or by using fake CAPTCHAs for social engineering”.

The campaign primarily targets English speakers, particularly those in the United States, Canada, Germany, and the United Kingdom.

OBSCURE#BAT gets its name from the fact that the attack starts with an obfuscated Windows batch script, which in turn executes PowerShell commands to activate a multi-step process that ends with the deployment of the rootkit.