The official web site for RVTools has been hacked to serve a compromised installer for the favored VMware atmosphere reporting utility.
“Robware.web and RVTools.com are presently offline. We’re working expeditiously to revive service and respect your persistence,” the corporate mentioned in a press release posted on its web site.
“Robware.web and RVTools.com are the one approved and supported web sites for RVTools software program. Don’t seek for or obtain purported RVTools software program from another web sites or sources.”
The event comes after security researcher Aidan Leon revealed that an contaminated model of the installer downloaded from the web site was getting used to sideload a malicious DLL that turned out to be a identified malware loader known as Bumblebee.
It is presently not identified how lengthy the trojanized model of RVTools had been accessible for obtain and what number of had put in it earlier than the location was taken offline.
Within the interim, customers are really helpful to confirm the installer’s hash and assessment any execution of model.dll from consumer directories.
The disclosure comes because it has come to mild that the official software program equipped with Procolored printers included a Delphi-based backdoor known as XRed and a clipper malware dubbed SnipVex that is able to substituting pockets addresses within the clipboard with that of a hard-coded deal with.
Particulars of the malicious exercise had been first found by Cameron Coward, who’s behind the YouTube channel Serial Hobbyism.
XRed, believed to be energetic since a minimum of 2019, comes with options to gather system data, log keystrokes, propagate through linked USB drives, and execute instructions despatched from an attacker-controlled server to seize screenshots, enumerate file methods and directories, obtain recordsdata, and delete recordsdata from the system.
“[SnipVex] searches the clipboard for content material that resembles a BTC deal with and replaces it with the attacker’s deal with, such that cryptocurrency transactions can be diverted to the attacker,” G DATA researcher Karsten Hahn, who additional investigated the incident, mentioned.
However in an fascinating twist, the malware infects .EXE recordsdata with the clipper performance and makes use of an an infection marker sequence – 0x0A 0x0B 0x0C – on the finish to keep away from re-infecting the recordsdata a second time. The pockets deal with in query has acquired 9.30857859 BTC (about $974,000) up to now.
Procolored has since acknowledged that the software program packages had been uploaded to the Mega file internet hosting service in October 2024 through USB drives and that the malware might have been launched throughout this course of. Software program downloads are presently solely accessible for F13 Professional, VF13 Professional, and V11 Professional merchandise.
“The malware’s command-and-control server has been offline since February 2024,” Hahn famous. “So it’s not potential that XRed established a profitable distant connection after that date. The accompanying clipbanker virus SnipVex remains to be a critical menace. Though transactions to the BTC deal with stopped on March 3, 2024, the file an infection itself damages methods.”
