RobotDropper Automates the Delivery of Multiple Infostealers

SUMMARY :

A phishing campaign is distributing Trojanized MSI files that use DLL sideloading to execute LegionLoader, a malicious program that delivers multiple infostealers. The campaign is widespread, with over 400 unique malicious MSI files identified since June 2024. Victims are targeted globally through links from .monster domains forwarded to cloud providers. The attack chain involves downloading a ZIP file containing a malicious MSI, which retrieves a password from a C2 server to unpack a RAR file and extract a malicious DLL. LegionLoader then downloads various infostealers and communicates with multiple domains. The infrastructure heavily utilizes Cloudflare, making tracing difficult. Mitigation involves sourcing software from legitimate sources, keeping systems updated, and using reputable antivirus software.

OPENCTI LABELS :

phishing,infostealer,dll sideloading,robotdropper,legionloader


Open in NetmanageIT OpenCTI Public Instance with below link!


Use public read only username and password on login page.

NOTE : Use Public READ only user credentials on login page banner.


RobotDropper Automates the Delivery of Multiple Infostealers