Over 100 Organizations Targeted by StrelaStealer Malware

Over 100 organizations across the European Union and the United States have been targeted by a sophisticated malware known as StrelaStealer. This information-stealing malware, designed to harvest email credentials from popular email clients, has seen a surge in activity through large-scale phishing campaigns identified in November 2023 and continuing into early 2024.

According to Palo Alto Networks' Unit 42 researchers, "These campaigns come in the form of spam emails with attachments that eventually launch the StrelaStealer's DLL payload."

StrelaStealer's impact is widespread, affecting sectors such as high tech, finance, professional and legal services, manufacturing, government, energy, insurance, and construction. The malware's operators have refined their phishing techniques, tailoring attacks to local languages and employing obfuscation methods to complicate analysis and detection efforts.

"In an attempt to evade detection, attackers change the initial email attachment file format from one campaign to the next, to prevent detection from the previously generated signature or patterns," Unit 42 researchers explained.

Security experts emphasized the effectiveness of phishing and spear-phishing as attack vectors. "All it takes is one user to have a lapse in judgment and download something they shouldn't," as stated by Adam Neel, a threat detection engineer speaking to SC Media. The rise of StrelaStealer and its successful targeting of a significant number of organizations underscore the importance of advanced security measures and employee education in combating phishing attacks.

The recent StrelaStealer campaigns have been characterized by updated obfuscation and the removal of debugging symbol strings observed in earlier attacks. This evolution in the malware's delivery and execution mechanisms underscores the ongoing challenge faced by cybersecurity professionals in detecting and mitigating such threats.

Similar incidents in the past, such as the Ov3r_Stealer information-stealing malware, highlight the recurring nature of these threats and the forever-ongoing battle between cybercriminals and cybersecurity professionals.