Site icon TheCyberThrone

WarmCookie Malware Dissection

PravinKarthik
Advertisements

WarmCookie, also known as BadSpace, is a new malware family that has been actively distributed through malspam and malvertising campaigns since April 2024.

Uppn compromise, the malware will have persistent access to networks and has been observed as an initial payload, often leading to the deployment of additional malware such as CSharp-Streamer-RAT and Cobalt Strike

WarmCookie campaigns use job offers or invoices themes to entice victims into clicking malicious links that deliver WarmCookie via email attachments or embedded hyperlinks that initiate the infection process.

Advertisements

The malware offers extensive functionality, including command execution, screenshot capture, and payload deployment, making it a valuable tool for maintaining long-term control of compromised systems.

The analysis also links WarmCookie to a threat group known as TA866. WarmCookie shares similarities with another malware family known as Resident Backdoor, which has previously been deployed in TA866 campaigns and ioverlaps in core functionality and coding conventions, suggesting that both malware families were likely developed by the same entity.

WarmCookie’s infection chain typically starts with malicious JavaScript downloaders delivered through either malspam or malvertising. Once executed, these scripts retrieve the WarmCookie payload, allowing the attackers to maintain persistent access within the compromised environment.

Advertisements

WarmCookie keeps evolving, with updates to its persistence mechanism, command structure, and sandbox detection capabilities.

The researchers expect WarmCookie to continue evolving as threat actors refine its functionality. Its connection to TA866 and the similarities with Resident Backdoor highlight a continued effort to build and maintain sophisticated tools for long-term cyber espionage and exploitation.

This research was documented by researchers from Cisco Talos, and for more information, refer to the blog

Indicators of Compromise

Exit mobile version