Seqrite – a specialist provider of cybersecurity products and services – has detected a new wave of Adwind Java Remote Access Trojan (RAT) campaign targeting Indian co-operative banks using Covid-19 as a bait. Researchers at Seqrite warned that if attackers are successful, they can take over the victim’s device to steal sensitive data like SWIFT logins and customer details and move laterally to launch large scale cyberattacks and financial frauds. Seqrite is successfully detecting and blocking any such attempts using its patented Signatureless and Signature-based detection technology.
According to the researchers at Seqrite, the Java RAT campaign starts with a spear-phishing email that claims to have originated from either Reserve Bank of India or a nationalized bank. The content of the email refers to COVID-19 guidelines or a financial transaction, with detailed information in an attachment, which is a zip file containing a JAR based malware
Upon further investigation, researchers at Seqrite found that the JAR based malware is a Remote Access Trojan that can run on any machine which has Java runtime enabled and hence it can impact a variety of endpoints, irrespective of their base Operating System. Once the RAT is installed, the attacker can take over the victim’s device, send commands from a remote machine, and spread laterally in the network. In addition, this malware can also log keystrokes, capture screenshots, download additional payloads, and extract sensitive user information.