{"id":97228,"date":"2019-10-28T11:10:37","date_gmt":"2019-10-28T18:10:37","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=97228"},"modified":"2025-08-12T02:52:47","modified_gmt":"2025-08-12T09:52:47","slug":"creepiest-threats","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/creepiest-threats\/","title":{"rendered":"A Cybersecurity Horror Story: Stay Secure From October\u2019s Creepiest Threats"},"content":{"rendered":"

Halloween time is among us and ghosts and goblins aren\u2019t the only things lurking in the shadows. This past month has brought a variety of spooky cyberthreats that haunt our networks and devices. From malicious malware to restricting ransomware, October has had its fair share of cyber-scares. Let’s take a look at what ghoulish threats have been leading to some tricks (and no treats) around the cybersphere this month.<\/p>\n

Ghostcat Malware <\/strong><\/h2>\n

One ghost that recently caused some hocus pocus across the Web is Ghostcat-3PC<\/a>. According to\u00a0SC Magazine<\/a>, the malware\u2019s goal is to hijack users\u2019 mobile browsing sessions.<\/p>\n

The infection begins when a user visits a particular website and is served a malicious advertisement. Ghostcat fingerprints the browser<\/a> to collect device information and determines if the ad is running on a genuine webpage. Ghostcat also checks if the ad is running on an online publishers\u2019 page that has been specifically targeted by this campaign. If these conditions are met, then the malware serves a malicious URL linked to the ad.<\/p>\n

From there, this URL delivers obfuscated JavaScript, which creates an obscure source or machine code. The attackers behind Ghostcat use this to trick the publishers\u2019 ad blockers, preventing them from detecting malicious content. The code also checks for additional conditions necessary for the attack, like ensuring that the malware is being run on a mobile device and a mobile-specific browser, for example. If the malware concludes that the browsing environment fits the descriptions of their target, it will serve a fraudulent pop-up, leading the user to malicious content.<\/p>\n

Bewitched WAV Files <\/strong><\/h2>\n

Ghostcat isn\u2019t the only way malware is being spread lately, as, according to ZDNet<\/a>, attackers have manipulated WAV audio files to spread malware and cryptominers. By using a technique called stenography<\/a>, malware authors can hide malicious code inside of a file that appears normal, which allows hackers to bypass security software and firewalls.<\/p>\n

Previously, cybercriminals have used stenography revolving around image file formats like PNG or JPEG. However, these crooks have now upped the ante by using WAV audio files to hide different types of malware. Most recently, researchers found that this technique is used to hide DLLs, or dynamic link libraries that contain code and data that can be used by more than one program at the same time. If malware was already present on an infected host device, it would download and read the WAV file, extract the DLL, and install a cryptocurrency miner called XMRrig. Cryptocurrency miners<\/a> compile all transactions into blocks to solve complicated mathematical problems and compete with other miners for bitcoins. To do this, miners need a ton of computer resources. As a result, miners tend to drain the victim\u2019s device of its computer processor\u2019s resources, creating a real cybersecurity headache.<\/p>\n

MedusaLocker Ransomware <\/strong><\/h2>\n

Finally, we have the mysterious MedusaLocker ransomware. According to BleepingComputer<\/a>, this threat is slithering its way onto users\u2019 devices, encrypting files until the victim purchases a decryptor.<\/p>\n

This strain will perform various startup routines to prep the victim’s device for encryption. Additionally, it will ensure that Windows networking is running and mapped network drives (shortcuts to a shared folder on a remote computer or server) are accessible. Then, it will shut down security programs, clear data duplicates so they can\u2019t be used to restore files, remove backups made with Windows backup, and disable the Windows automatic startup repair.<\/p>\n

For each folder that contains an encrypted file, MedusaLocker creates a ransom note with two email addresses to contact for payment. However, it is currently unknown how much the attackers are demanding for the victim to have their files released or if they actually provide a decryptor once they receive a payment.<\/p>\n

With all of these threats attempting to haunt networks and devices, what can users do to help themselves have a safe and secure spooky season? Follow these tips to keep cybersecurity tricks at bay:<\/p>\n