Hello, welcome to the Tuesday, March 16th, 2021 edition of the Sandstone Storm Center's Stormcast. My name is Johannes Ulrich. And while I'm recording today from Jacksonville, I'm actually teaching a class that was supposed to be happening in San Diego. It's also, of course, just about a year that, well, I'm recording

from Jacksonville, Florida exclusively. But glasses, of course, continue worldwide. It's just

all the jet lag without any of the travel. Proofpoint came across an interesting piece of

Malver that they're calling N Nimzaloder. The name is

derived in part from NIM, the programming language that was used to create this malver. Now, if you

haven't heard of NIM, you're not alone. I didn't hear about it, I have to admit, until I read about

this malware.

But if you sort of read the boilerplate on what's good about NIM, it kind of gives you an idea

why attackers may choose this language. And it says here that NIM generates native dependency-free

executables, not dependent on a virtual machine, which are small and easy

for redistribution. And of course, any new and a little bit odd programming language like

this is probably going to create somewhat unique and different binaries that will evade

traditional signatures.

The distribution methods follow the more standard pattern of first sending an email.

Now, in this case, the emails tend to be a bit more personalized, and then a link in the email

will direct the victim to the actual binary that actually happens

to be hosted within Slack. That's yet another trick that tends to be quite successful

in evading filters, given that Slack is now a very commonly used enterprise tool. And in the example described by

ProofPoint, the malware claims to be a PDF button, of course, isn't executable, and the

user will be tricked into clicking and with that executing the file. Nimza Loader is, as the

name implies, just a loader, so it downloads additional malware after it's installed, and the proofpoint does find that it tends to be used then to install Cobalt Strike.

And Microsoft released an emergency update for Windows 10, and in this case, not to fix a vulnerability,

...