Microsoft Tracks New BazaCall Malware Campaign

Attackers use emails to prompt victims to call a fraudulent call center, where attackers instruct them to download a malicious file.

Microsoft Security Intelligence is tracking an active BazaCall malware campaign that leads to ransomware deployment, officials reported in a Twitter thread yesterday.
The BazaCall campaigns use emails that instruct recipients to call a number to cancel their supposed subscription to a service. When victims call the number, they reach a fraudulent call center operated by attackers who tell them to visit a website and download an Excel file in order to cancel the service. This file contains a malicious macro that downloads the payload.
In this attack, Microsoft saw attackers using Cobalt Strike and report they stole credentials — including the Active Directory database — and exfiltrated data using rclone.
This campaign is named after BazaLoader (also called BazarLoader), the malware it initially distributed, company officials wrote. The malware is designed to provide backdoor access to an infected Windows device. With this level of access, attackers can send other forms of malware, scan the target environment, and go after other vulnerable machines on the same network.
The group behind BazaLoader uses different methods to distribute its malware. The method of using a call center emerged in early February 2021, said Brad Duncan, threat intelligence analyst for Palo Alto Networks Unit 42, in a
May blog post
on the threat. He noted that phone numbers in the attackers emails change at least daily, and occasionally, researchers saw more than two numbers appear in a day.
Read more details on the newest campaign in Microsofts
Twitter thread
.

Last News
▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security	▸ Making use of a homemade Android army ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Tracks New BazaCall Malware Campaign