Gazorp, a free malware builder spotted on the dark web, lets would-be threat actors create customized AZORult attacks.

First discovered by Check Point Research on Sept. 17, the new builder makes it easy to generate custom samples of the AZORult infostealer. According to Gazorp’s creators, developing malware with the tool is “as simple as 2×2”: Prospective users provide their command-and-control (C&C) address, download the malware builder, install the panel and deploy their new creation in the wild.

Gazorp builds samples of AZORult version 3.0, which was released five months ago. Since that time, two newer versions — 3.1 and 3.2 — have been released, limiting the efficacy of Gazorp’s version. As Check Point made clear, however, the outdated version has “multiple stealing capabilities which can be leveraged by any actor to gather victim information and misuse it.”

Gazorp’s Expanding Threat Capabilities

Gazorp’s authors have added several new panel features and code upgrades to boost the impact of their AZORult version. Notable improvements include the addition of a global heat map that provides country-by-country statistics and the ability to create a complex mutex based on multiple factors, including admin, user, system and guest authorities. In addition, this Gazorp version includes vulnerability and bug fixes to version 3.0, along with visual user interface (UI) enhancements.

But that’s not all. The malware builder also includes a Telegram channel link that features the ongoing work of Gazorp’s authors. Users who visit the channel can get updates on new features, add their own suggestions and donate bitcoin to help drive future improvements. The creators made it clear: “More donations, more updates.” According to Check Point, it appears the project will evolve over time and “possibly produce new variants for AZORult.”

How to Protect Enterprise Data From a Malware Builder

Tackling the problem of custom malware code starts with consistent patching. Security experts note that “the bulk of security issues simply come down to software patching,” and this is certainly the case with Gazorp. Given its use of outdated AZORult code, regular security patching will frustrate most free-to-play malware attackers.

Security teams should also consider investing in security-as-a-service (SECaaS) solutions. Check Point noted that new Gazorp attacks may begin to emerge at a higher scale as more attackers discover the service. Attempting to track evolving, emerging infections without the benefit of on-demand security resources quickly becomes an exercise in frustration — and could lead to network compromise.

Source: Check Point Research

More from

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.The…

Container Drift: Where Age isn’t Just a Number

Container orchestration frameworks like Kubernetes have brought about untold technological advances over the past decade. However, they have also enabled new attack vectors for bad actors to leverage. Before safely deploying an application, you must answer the following questions: How long should a container live? Does the container need to write any files during runtime?Determining the container’s lifetime and the context in which it runs is critical, especially when hosting an internet-facing service.What is Container Drift?When deploying an application within…

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

OneNote, Many Problems? The New Phishing Framework

There are plenty of phish in the digital sea, and attackers are constantly looking for new bait that helps them bypass security perimeters and land in user inboxes. Their newest hook? OneNote documents. First noticed in December 2022, this phishing framework has seen success in fooling multiple antivirus (AV) tools by using .one file extensions, and January 2023 saw an attack uptick as compromises continued. While this novel notes approach will eventually be phased out as phishing defenses catch up,…