In the rapidly evolving landscape of cybersecurity threats, the loader-as-a-service (LaaS) model known as FakeBat has emerged as one of the most pervasive and concerning malware families in 2023. Distributed primarily through drive-by download attacks, FakeBat has been implicated in a series of sophisticated campaigns designed to compromise user systems and facilitate the deployment of various malicious payloads.
The Mechanics of FakeBat
According to a detailed analysis by cybersecurity firm Sekoia, FakeBat’s primary function is to download and execute next-stage payloads. These payloads include notorious malware strains such as IcedID, Lumma, RedLine, SmokeLoader, SectopRAT, and Ursnif. The loader achieves this by leveraging methods like search engine optimization (SEO) poisoning, malvertising, and injecting malicious code into compromised websites. These tactics aim to trick users into downloading fake software installers or browser updates, thereby initiating the malware infection process.
The rise of FakeBat underscores the broader trend of cybercriminals using sophisticated social engineering and phishing techniques to gain initial access to victim systems. By masquerading as legitimate software installers, these loaders deceive users and bypass initial security defenses, paving the way for further exploitation.
Origins and Evolution
FakeBat, also known by aliases such as EugenLoader and PaykLoader, has been available as a LaaS subscription on underground forums since at least December 2022. It is distributed by a Russian-speaking threat actor known as Eugenfest (or Payk_34). This malware-as-a-service model allows other cybercriminals to use FakeBat by subscribing to different packages, thereby lowering the barrier to entry for launching sophisticated cyberattacks.
Early versions of FakeBat utilized the MSI format for malware builds. However, recent iterations observed since September 2023 have transitioned to the MSIX format, incorporating a digital signature with a valid certificate to evade Microsoft SmartScreen protections. The loader is offered at various price points: $1,000 per week or $2,500 per month for the MSI format, $1,500 per week or $4,000 per month for the MSIX format, and $1,800 per week or $5,000 per month for the combined MSI and signature package.
Distribution Tactics
Sekoia’s findings highlight three primary methods through which FakeBat is disseminated:
- Malicious Google Ads: Cybercriminals impersonate popular software through deceptive ads, luring users into downloading malware-laden installers.
- Fake Browser Updates: Compromised websites prompt users to install bogus browser updates, which in reality contain the FakeBat loader.
- Social Engineering Schemes: Attackers utilize social networks to spread malware, often by impersonating trusted entities or exploiting trending topics.
Notably, some campaigns involving FakeBat have been linked to known cybercriminal groups such as FIN7, Nitrogen, and BATLOADER. These groups employ complex tactics to distribute the malware, often filtering traffic based on characteristics like User-Agent values, IP addresses, and geographic locations to target specific victims.
Related Threats and Trends
The proliferation of loader malware extends beyond FakeBat. For instance, the AhnLab Security Intelligence Center (ASEC) recently uncovered a campaign distributing DBatLoader (also known as ModiLoader and NatsoLoader) via invoice-themed phishing emails. Additionally, infection chains involving Hijack Loader (DOILoader or IDAT Loader) have been observed propagating through pirated movie download sites, ultimately delivering the Lumma information stealer.
Researchers at Kroll have noted the sophisticated techniques used in these campaigns. For example, the IDATLOADER campaign utilized Microsoft’s mshta.exe to execute malicious code hidden within a file disguised as a PGP Secret Key. This campaign employed heavy obfuscation and innovative methods to evade detection.
Furthermore, new phishing campaigns have been identified, distributing Remcos RAT through loaders and emails. An Eastern European threat actor, dubbed Unfurling Hemlock, has been using these techniques to drop multiple malware strains simultaneously, acting as a “cluster bomb” of malicious activity. The payloads include stealers like RedLine, RisePro, and Mystic Stealer, as well as loaders such as Amadey and SmokeLoader.
Conclusion
The rise of FakeBat and similar loader malware highlights the growing sophistication and adaptability of cybercriminals. As these threats continue to evolve, it becomes increasingly crucial for individuals and organizations to stay vigilant, employ robust security measures, and remain informed about the latest tactics used by threat actors. By understanding and mitigating these risks, we can better protect our digital environments from the ever-present threat of malware attacks.
Follow us on 
(Twitter) for real time updates and exclusive content.
Interesting Article : Uncovering ‘Indirector’: A New Vulnerability Exposing Sensitive Data in Intel CPUs
Pingback: Cobalt Strike Misuse: Operation MORPHEUS Against Cybercrime