Rescuerity ne PDFSIDER malware ki pehchaan ki hai jo asalee pdf24 app ka istmaal karke chupke se data churata hai aur remote access ki ijaazat deta hai. jaane ki yah APT-level campaign spear-phishing aur encrypted communication ke zarie corporate networks ko kaise target karta hai.
ekk naya cyber security khatara pata chala hai jo ek aam office tool ka istmaal karke backdoor banata hai. PDFSIDER naam ke is malware ki pehchaan haal hi mein research pharm resecurity ne ki thi, jab ek fortune 100 corporation ne uske network mein sendh lagane kee kosish ko break rok diya tha.
How Legitimate Software is Being Manipulated
Attack spear-phising email se shuru hota hai jo bahut zyada targeted message hote hain jo shikaar logo ko zip file download karne ke liye dhokha dete hain. iske andar pdf24 app naam ka ek aslee prograam hai, Miron Geek Software GmbH. ne banaya hai. halanki app khud document ko mannage karane ka ek asli tool hai, hackers DLL side-loading naam ki technique ka istemaal karke iskee kamazoriyon ka faayada uthaate hain.
is maamle mein, yeh tarika cryptbase.dll naam kee ek khatarnaak files ko asli PDF24.exe. vale folder mein rakhkar kaam karta hai. jab users program kholta hai, to computer ko asli system file ke bajaay attacker ka code load karne ke liye dhokha diya jaata hai. malware poori tarah se system ki memory mein chalata hai, jisse yah tredisnal antivirus ko Bypass kar
pata hai.