[SaMoo7]

FBI alerts US private sectors about attacks aimed at their supply chain software providers. The FBI has sent a security alert to the US private sector about an ongoing hacking campaign; FBI says hackers are attempting to infect companies with the Kwampirs RAT. The alert did not identify the targeted software providers, nor any other victims.



This RAT use "CreateProcessAsUserW" for the creation of second instance of a genuine process, under rundll32 with credentials of current logged in user, for example, you can see in the above pic Genuine Process - "wmiapsrv.exe" and tempered process is "wmipvsre.exe"

[refa]

Interesting news. I've heard of this rat.

[mothered]

A sophisticated attack that can certainly cause significant damage.

To the untrained eye, the process looks very legit.

[SaMoo7]

A sophisticated attack that can certainly cause significant damage.

To the untrained eye, the process looks very legit.

Exactly