Hackers use a Python clone of Minesweeper to target finance institutions
2 min. read
Published on
Share this article
Read our disclosure page to find out how can you help Windows Report sustain the editorial team Read more
Hackers are using a code from a Python clone of Minesweeper to attack financial and insurance organizations from the United States and Europe. According to Bleeping Computer, the Computer Security Incident Response Team (CSIRT-NBU) and the Computer Emergency Response Team of Ukraine (CERT-UA) tracked the attack and found UAC-0188 responsible.
The UAC-0188, also known as FromRussiaWithLove, is a Russian hacktivist. The attackers use the Minesweeper code to hide their Python scripts that install the SuperOps RMM, a tool that helps them gain access to the affected systems.
How do hackers use the Minesweeper code?
The wrongdoers disguise themselves as a medical center. They use the [email protected] email. In addition, the subject of the mail is Personal Web Archive of Medical Documents.
In the email, recipients can find a Dropbox link, which leads to a 33 MB .SCR file that contains the code from the Python clone of Minesweeper and a malicious one that downloads additional malware from anotepad.com.
The Python clone of Minesweeper serves as a decoy for the real 28MB base64-encoded string, which contains the malicious code. Also, the create_license_ver function contained by the code decodes and executes the malware. This process hides the malicious code from security systems.
When the function finishes decoding, it reveals a .ZIP file containing the SuperOps RMM. Then, it extracts and executes it using a static password.
Cybersecurity specialists recommend that if you notice SuperOPS RMM activity on your device, you should be cautious, especially if your organization doesn’t use it. Also, check for calls to the following domains: superops.com and superops.ai. In addition, use an updated antivirus device, back up important data, and change your passwords regularly.
Ultimately, the Minesweeper malware is a serious threat that you shouldn’t treat lightly. CERT-UA revealed five similar files sent in the US and EU. So, be cautious, especially if you run a financial organization.
