Top Highlights
- Threat actors embedded malicious PE files and DLL payloads within PNG images using full-bit steganography, making detection difficult and preserving payload integrity.
- The steganographic technique involves storing payloads in the image pixel data, with actors using all available bits, rendering the images visually unaltered but malicious underneath.
- The campaign deploys a multistage intrusion with reverse tunnels, leveraging steganography to evade detection and facilitate covert malware delivery and sideloading attacks.
Threat, Attack Techniques, and Targets
The campaign is called TerminalFix, and it uses PNG files with steganography to hide malicious data. The threat actors embed a payload within PNG images by using all available bits, making it difficult to detect visually. These images appear as normal PNG files and contain valid image data. Inside the images, the payload is a malicious DLL split into two parts, also stored using all bits in the pixel data. The PNG files include a hidden PE file, which is used for sideloading. The target of this attack involves using these steganographic images to deliver malware covertly. The campaign shows that cybercriminals are employing sophisticated steganography techniques to hide malicious code within standard image files.
Impact, Security Implications, and Remediation Guidance
This technique allows attackers to hide malicious code within seemingly innocent images. Because the images look normal and contain valid image data, they are hard to detect with basic security tools. If the images are opened or transferred, the embedded payload can be extracted and executed, leading to harmful malware infections. The use of all bits for steganography increases the risk of unnoticed data exfiltration or malware delivery. Security teams must be aware of such steganography techniques and monitor PNG files that appear unusual or contain embedded data. Since specific remediation guidance is not provided in the source, organizations should seek advice from their security vendors or relevant authorities for detection and removal methods related to steganographic malware in images.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
