{"id":44088,"date":"2021-11-23T00:00:00","date_gmt":"2021-11-23T00:00:00","guid":{"rendered":"urn:uuid:b3de07b3-b8a7-ab0e-2f70-29d49ee98dd0"},"modified":"2021-11-23T00:00:00","modified_gmt":"2021-11-23T00:00:00","slug":"bazarloader-adds-compromised-installers-iso-to-arrival-and-delivery-vectors","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/bazarloader-adds-compromised-installers-iso-to-arrival-and-delivery-vectors\/","title":{"rendered":"BazarLoader Adds Compromised Installers, ISO to Arrival and Delivery Vectors"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Conclusion<\/span><\/p>\n

The number of arrival mechanism variations used in BazarLoader campaigns continue to increase as threat actors diversify their attack patterns to evade detection. However, both techniques are noteworthy and still work despite their lack of novelty due to singular detection technologies\u2019 limitations. For instance, while the use of compromised installers has been observed with other malware, the large file size can still challenge detection solutions \u2014 such as sandboxes \u2014 which may implement file size limits. On the other hand, LNK files serving as shortcuts will also likely be obfuscated for the additional layers created between the shortcut and the malicious files itself.<\/p>\n

In addition, the deployment of BazarLoader malware for initial access is a known technique for modern ransomware such as Conti and Ryuk as service affiliates. Aside from these known ransomware families including more tools for entry into their arsenal, other malware groups and ransomware operators may pick up on the additional means, if they have not already done so.<\/p>\n

Best practices<\/span><\/p>\n

BazarLoader is an example of a versatile malware delivery mechanism that will likely find more ways to adapt to deceive more users. For details on all the other measures that BazarLoader uses to get into systems, read our technical brief here<\/a>.<\/p>\n

Here are some best practices to defend against this threat:<\/p>\n