In October and November 2023 [1] [3] [4] [5] [6] [7], cybersecurity firm ESET observed a significant increase in the activity of the Win/TrojanDownloaderRugmi malware loader. This surge in detections is attributed to the availability of ready-made malware solutions [3], which have made it easier for less technically skilled threat actors to distribute various information stealers.
Description
The Rugmi loader consists of three components: a downloader that retrieves an encrypted payload [1] [4] [5], a loader that executes the payload from internal resources [1] [4] [5], and another loader that runs the payload from an external file on the disk [1] [4] [5]. This loader has gained popularity due to the wide range of functions offered by Lumma Stealer, one of the information stealers it distributes. Other information stealers distributed by the Rugmi loader include Vidar, RecordBreaker [1] [2] [3] [4] [5] [6] [7], and Rescoms [1] [2] [3] [4] [5] [6] [7]. The number of daily detections of the Rugmi loader has increased significantly, from single digits to hundreds [4] [6] [7].
Conclusion
The rise in detections of the Rugmi loader highlights the impact of readily available malware solutions on the distribution of information stealers. The accessibility of these solutions has lowered the barrier for less technically skilled threat actors, leading to an increase in their malicious activities. To mitigate the risks posed by these malware loaders, it is crucial for organizations and individuals to maintain robust cybersecurity measures and stay updated with the latest threat intelligence. Additionally, the surge in detections serves as a reminder of the evolving nature of cyber threats and the need for continuous efforts in developing effective countermeasures.
References
[1] https://ciso2ciso.com/new-rugmi-malware-loader-surges-with-hundreds-of-daily-detections-sourcethehackernews-com/
[2] https://cyber.vumetric.com/security-news/2023/12/28/new-rugmi-malware-loader-surges-with-hundreds-of-daily-detections/
[3] https://flyytech.com/2023/12/28/new-rugmi-malware-loader-surges-with-hundreds-of-daily-detections/
[4] https://thehackernews.com/2023/12/new-rugmi-malware-loader-surges-with.html
[5] https://www.redpacketsecurity.com/new-rugmi-malware-loader-surges-with-hundreds-of-daily-detections/
[6] https://www.funnier9.com/new-rugmi-malware-loader-surges-with-a-whole-lot-of-day-by-day-detections/
[7] https://owasp.or.id/2023/12/28/new-rugmi-malware-loader-surges-with-hundreds-of-daily-detections/
