Whichever method was used, they would all utilise an installer which would deliver and execute the PHP-based SYS01stealer malware.

The DLL would abuse applications such as Western Digital's WDSyncService.exe and Garmin's ElevatedInstaller.exe and may also deploy Python and Rust-based executable files. This would allow the loading of a malicious DLL(Dynamic Link Library), along with the ‘legitimate’ app. Opening the compromised file would launch a based side loader, typically a C# application, that was vulnerable to side loading. Israeli cyber security company ‘Morphisec’ tied the attack to a threat actor which had previously been identified as responsible for the ‘Ducktail’ attack, which targeted high-level employees of a company who had access to the company's Facebook business account, stealing their data, hijacking the account and holding it for financial gains.

The attack itself was designed to retrieve personal sensitive information such as login credentials, cookies, Facebook ads and business account information. Facebook business accounts were targeted by the threat actors using fake profiles and fake Google ads which advertised games, adult content and unlocked software downloads, which when followed would download malicious software. Named SYS01stealer, by researchers, it targets government, and critical national infrastructure manufacturing, amongst other sectors. What happened: A new information and data-stealing piece of malware have been discovered.

Parties involved: Facebook, Unknown Threat Actor, Morphisec, Google, Microsoft, Western Digital, Garmin

Microsoft malware tool