A phishing campaign is distributing Trojanized MSI files that use DLL sideloading to execute LegionLoader, a malicious program that delivers multiple infostealers. The campaign is widespread, with over 400 unique malicious MSI files identified since June 2024. Victims are targeted globally through links from .monster domains forwarded to cloud providers. The attack chain involves downloading a ZIP file containing a malicious MSI, which retrieves a password from a C2 server to unpack a RAR file and extract a malicious DLL. LegionLoader then downloads various infostealers and communicates with multiple domains. The infrastructure heavily utilizes Cloudflare, making tracing difficult. Mitigation involves sourcing software from legitimate sources, keeping systems updated, and using reputable antivirus software. Author: AlienVault
Related Tags:
Rilide Stealer
LummaStealer
LegionLoader
T1218.007
T1036.005
stealc
DLL Sideloading
rhadamanthys
T1059.001
Associated Indicators:
2CC19691E4CD643377A2553FF665799C66B3AFF324AC544E9A9D8C4CB623AE94
A970226823FE040895E40B04BFC56B871C0450C2107594F42109F46F48B5E972
14B6F5C640C73CDD99E5834E7A56AB3D2912ABE623BF5E41946154DAD69E5F26