Home / Technology / JPEG Malware Hides Advanced Cyber Attack
JPEG Malware Hides Advanced Cyber Attack
12 May
Summary
- Attackers use weaponized JPEG files to deliver PowerShell payloads.
- Malware establishes persistence via a fake OneDrive service.
- Campaign uses a trojanized ScreenConnect for covert remote access.
Security researchers have identified a new hacking campaign, named Operation SilentCanvas, which weaponizes seemingly innocuous .jpeg files to execute malicious PowerShell payloads. The campaign is characterized by its professionally engineered and operationally mature intrusion framework, capable of long-term covert persistence and enterprise espionage.
The attack chain begins with a user downloading a file disguised as 'sysupdate.jpeg'. Upon execution, this file triggers a PowerShell payload that downloads further tools from the attacker's infrastructure. A key component is a trojanized version of ConnectWise ScreenConnect, which grants covert remote access.
This malware is designed to bypass Windows security measures by creating malicious registry entries, effectively establishing persistence under the guise of a fake Windows service named 'OneDriveServers'. It also features encrypted command-and-control communications and sophisticated surveillance capabilities.
Cyfirma, the research firm that detailed the campaign, highlights its advanced nature, including credential theft, system fingerprinting, screen capture, and microphone monitoring. The framework's maturity suggests potential for lateral movement and ransomware deployment within targeted enterprises.
