Industrial and government organizations, including enterprises in the military-industrial complex and research laboratories, are the targets of a new malware botnet dubbed PseudoManyscrypt that has infected roughly 35,000 Windows computers this year alone.
The name comes from its similarities to the Manuscrypt malware, which is part of the Lazarus APT group’s attack toolset, Kaspersky researchers said, characterizing the operation as a “mass-scale spyware attack campaign.” The Russian cybersecurity company said it first detected the series of intrusions in June 2021.
At least 7.2% of all computers attacked by the malware are part of industrial control systems (ICS) used by organizations in engineering, building automation, energy, manufacturing, construction, utilities, and water management sectors that are located mainly in India, Vietnam, and Russia. Approximately a third (29.4%) of non-ICS computers are situated in Russia (10.1%), India (10%), and Brazil (9.3%).
“The PseudoManuscrypt loader makes its way onto user systems via a MaaS platform that distributes malware in pirated software installer archives,” the Kaspersky ICS CERT team said. “One specific case of the PseudoManuscrypt downloader’s distribution is its installation via the Glupteba botnet.”
Coincidentally, Glupteba’s operations have also taken a significant hit after Google earlier this month disclosed that it acted to dismantle the botnet’s infrastructure and it’s pursuing a litigation against two Russian nationals, who are alleged to have managed the malware along with 15 other unnamed individuals.
images from Hacker News