Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
Some cyber criminals have created a web page impersonating the official website of a tool called BleachBit. The cyber criminals spread the AZORult information stealer in the name of this tool. BleachBit is a tool that helps Windows, Linux, and macOS users reclaim disk space by deleting disposable data and has more than one million downloads on Sourceforge.
AZORult is a stealer built to collect various types of sensitive data from an infected computer such as browser history, saved logins, stored credentials in FTP clients, desktop and text files, and more. When designing the malicious site, the domain bleachbitcleaner[.]com was used to appear legitimate. The webpage has only one link available which leads to AZORult, along with the embedded video tutorial for a beta version of the program released in 2009. Data is taken from infected computers to twooo[.]cn.
Once installed, AZORult contacts its command and control (C2) server for instructions. It can collect browser history, login credentials, cookies, and files in specific locations. Fooled users download a ZIP archive from Dropbox which steals a victim’s data on execution and uploads it to the attacker’s command and control servers.
Attack vector for this attack is still unclear. Threat actors may get victims to visit the fake webpage via search engines or manually push the fake website on support forums. They may also target users looking to securely erase sensitive data. They could also use phishing emails and push the link through email attachments.
URLs
Malware Hash (MD5/SHA1/SH256)