Attempts to disrupt Russian businesses with MetaStealer

Tags

External References

• https://bi-zone.medium.com/
• https://otx.alienvault.com/

Description

A previously unknown threat actor, Venture Wolf, has been targeting Russian businesses since November 2023. The group uses multiple loaders to deliver MetaStealer, a malware that focuses on manufacturing, construction, IT, and telecommunications industries. The campaign involves disseminating archives with loaders and phishing documents, using various file types as decoys. The loaders, which are obfuscated PE files, inject the malicious payload into dummy .NET files or RegAsm.exe processes. MetaStealer, a fork of RedLine, collects system information, retrieves data from browsers and crypto wallets, and steals information from email clients and other applications. The threat actor employs sophisticated techniques to evade detection and analysis.

Date