Kaspersky Lab

In August 2024, a new strain of crimeware named SteelFox was identified. This malware spreads through forums, torrent trackers, and blogs, disguised as legitimate software like Foxit PDF Editor and AutoCAD. It includes a stealer component that collects sensitive data, such as banking information and device details. SteelFox uses SSL pinning and TLS 1.3 for communication with its command server, which operates under a dynamic IP address. The malware can escalate privileges by exploiting vulnerabilities in drivers. The initial attack vector involves posts promoting a dropper that masquerades as software activators. The dropper executes an AMD64 executable that requests administrator rights and delivers the malicious payload. The payload is decrypted using AES-128 and modified to evade detection before being installed as a service that persists after reboots. SteelFox's final stage involves creating a service that interacts with a vulnerable driver, allowing privilege escalation to NTSYSTEM. The malware connects to a command server using TLS 1.3 and SSL certificate pinning to secure communications. Victims are primarily users of popular software, with significant infections detected globally, particularly in Brazil, China, and Russia. The campaign is attributed to posts made from hacked accounts or inexperienced users on platforms like Baidu and Russian torrent trackers. Indicators of compromise include specific file hashes, file paths, and domains associated with the malware's operation.