<h1>Spoofed GlobalProtect VPN Used to Deliver Unique WikiLoader Variant</h1>
<p>Unit 42’s Managed Threat Hunting team has uncovered a sophisticated malware campaign involving a unique variant of WikiLoader, distributed through SEO poisoning and spoofing Palo Alto Networks’ GlobalProtect VPN software. This tactic represents a deviation from traditional phishing methods, utilizing fake GlobalProtect download pages to initiate infections.</p>
<h2>Evasion Techniques and Target Sectors</h2>
<p>The malware employs advanced evasion techniques, including using renamed legitimate software and anti-analysis measures, to avoid detection. The primary targets of this campaign have been organizations within the U.S. higher education and transportation sectors, as well as entities in Italy.</p>
<h2>Detailed Operation Mechanics</h2>
<h3>Delivery Method</h3>
<p>The attackers use SEO poisoning to place attacker-controlled webpages at the top of search results, enticing users to download the spoofed software. Once a user downloads and executes the fake GlobalProtect installer, WikiLoader is activated.</p>
<h3>Command and Control Mechanisms</h3>
<p>Once installed, WikiLoader establishes communication with its command and control (C2) servers to receive instructions and carry out malicious activities. The malware is capable of privilege escalation, information disclosure, and command injection, posing significant risks to affected systems.</p>
<h2>Preventive Measures</h2>
<p>Palo Alto Networks customers are advised to update their software to mitigate vulnerabilities and employ robust defense mechanisms. Vigilance is necessary given the advanced evasion techniques used by WikiLoader.</p>
<h3>Hunting Queries and Indicators of Compromise</h3>
<p>The following resources have been provided for threat detection:</p>
<ul>
<li><strong>XQL Hunting Queries:</strong> Specific queries designed to identify suspicious activities related to the WikiLoader variant.</li>
<li><strong>Indicators of Compromise (IOCs):</strong> A detailed list of IOCs to help detect and prevent infections.</li>
</ul>
<h2>Conclusion</h2>
<p>This campaign underscores the evolving tactics of cybercriminals, leveraging SEO and spoofing trusted software to spread malware. Organizations, especially those within the targeted sectors, must adopt proactive security measures to defend against these sophisticated threats.</p>


Collections

A sophisticated malware campaign involving a unique variant of WikiLoader has been uncovered. Utilizing SEO poisoning and spoofing GlobalProtect VPN software, this campaign targets the U.S. higher education and transportation sectors, as well as entities in Italy. The malware uses advanced evasion techniques and establishes communication with command and control servers to carry out malicious activities. Organizations are advised to update software and employ robust security measures to defend against these threats.

Unit 42 Uncovers WikiLoader Variant Spoofing GlobalProtect VPN: Critical Advisory and Mitigation Measures