Windows Defender hacked to deploy this dangerous ransomware TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. Windows Defender hacked to deploy this dangerous ransomware By Sead Fadilpašić published 1 August 2022 Windows Defender is being abused to side-load LockBit 3.0 (Image credit: Future) Audio player loading… Log4j vulnerabilities are now being used to deploy Cobalt Strike beacons through the Windows Defender command line tool, researchers have found. Cybersecurity researchers from Sentinel Labs recently spotted a new method, employed by an unknown threat actor, with the endgame being the deployment of LockBit 3.0 ransomware. It works like this: the threat actor would leverage log4shell (as the Log4j zero-day is dubbed) to gain access to a target endpoint, and obtain the necessary user privileges. Once that's out of the way, they'd use PowerShell to download three separate files: a Windows CL utility file (clean), a DLL file (mpclient.dll), and a LOG file (the actual Cobalt Strike beacon). Side-loading Cobalt Strike They would then run MpCmdRun.exe, a command line utility that performs various tasks for Microsoft Defender. That program would usually load a legitimate DLL file - mpclient.dll, which it needs to correctly run. But in this instance, the program would load a malicious DLL of the same name, downloaded together with the program. That DLL will have the LOG file load and decrypt an encrypted Cobalt Strike payload. It's a method known as side-loading.Read more> Microsoft SQL servers hit by Cobalt Strike attacks (opens in new tab) > Patched Cobalt Strike vulnerabilities could have dealt a crippling blow to malicious users (opens in new tab) > Stay safe from cybercriminals with the best endpoint protection services around (opens in new tab) Usually, this LockBit affiliate used VMware's command line tools to side-load Cobalt Strike beacons, BleepingComputer says, so the switch to Windows Defender is somewhat unusual. The publication speculates the change was made to bypass targeted protections that VMware recently introduced. Still, using living-off-the-land tools to evade being detected by antivirus (opens in new tab) or malware (opens in new tab) protection services is "extremely common" these days, the publication concludes, urging businesses to check their security controls and be vigilant with tracking how legitimate executables are being (ab)used. Even though Cobalt Strike is a legitimate tool, used for penetration testing, it's grown quite infamous as it's being abused by threat actors everywhere. It comes with an extensive list of features that cybercriminals can use to map out the target network, undetected, and move laterally across endpoints, as they prepare to steal data and deploy ransomware. These are the best firewalls (opens in new tab) right now Via: BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1You may not have to sell a body part to afford the Nvidia RTX 4090 after all2One of the world's most popular programming languages is coming to Linux3The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me4Blizzard made me explain Overwatch 2 smurfing to my mum for nothing5Apple October launches: the new devices we might see this month1Best laptops for designers and coders 2The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me3Stop saying Mario doesn't have an accent in The Super Mario Bros. Movie4Microsoft Teams users are using it for a really bad reason, so stop now5iPhone 15 tipped to come with an upgraded 5G chip Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)