K7 LabsPublished
Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading
Excerpt
We came across fake Microsoft Teams distribution sites, shared on X platform back in mid April. The websites closely mimic the legitimate Microsoft Teams download page, using lookalike domains to trick users into downloading a trojanized installer packaged as a zip archive.
Figure 1: Fake teams site
Our investigation revealed that the delivered payload leverages a DLL sideloading chain via a legitimate executable (GameBox.exe) developed by Tencent, ultimately deploying a ValleyRAT variant. Indicators such as Chinese language artifacts within fake sites and log data suggest a likely connection to threat activity originating from China. T…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by K7 Labs on labs.k7computing.com.
Mentioned in the excerpt
More from K7 Labs2
- From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainK7 Labs · Published 18 Sep
- Threat actors target recent Election ResultsK7 Labs · Published 23 Jul 2024
