MintsLoader Strikes Again: A Comedy of Errors in Cybersecurity

Hot Take:

You know it’s serious when malware gets a makeover as fancy as MintsLoader’s! Just when you thought your inbox was safe, it’s time to brush up on your phishing instincts and remember: not every invoice needs to be paid, especially if it ends in .js!

Key Points:

• MintsLoader is a devious malware loader delivering GhostWeaver RAT via a multi-stage infection chain.
• The malware evades detection using obfuscation, sandbox/VM checks, and domain generation algorithms.
• Targets include the U.S. and European energy, oil, gas, and legal sectors.
• Fake CAPTCHAs and invoice files are used as lures to trick users into executing malicious scripts.
• MintsLoader C2 servers have shifted to more traditional bulletproof hosters for enhanced stability.

Phishing: It’s Not Just for Fishermen Anymore

MintsLoader is the malware equivalent of a Swiss Army knife, equipped with a range of features that would make even the most seasoned cybercriminal proud. The attack chain begins with phishing messages that could make an art forger blush. Whether it’s a fake browser update, an invoice from a non-existent client, or a CAPTCHA verification page that’s more fake than a reality TV show wedding, MintsLoader has got it all. This malware loader isn’t just a one-trick pony; it’s a multi-stage mastermind, delivering payloads like GhostWeaver RAT with the finesse of a magician pulling a rabbit out of a hat.

Obfuscation: The Cybercriminal’s Cloak of Invisibility

To stay out of the spotlight (and the antivirus crosshairs), MintsLoader employs obfuscation techniques that would make Harry Potter’s invisibility cloak look like amateur hour. Using obfuscated JavaScript and PowerShell scripts, this malware ensures that its nefarious activities remain hidden from prying eyes. It also boasts sandbox and virtual machine evasion techniques, making it as slippery as a greased-up otter. If that wasn’t enough, MintsLoader’s use of a domain generation algorithm and HTTP-based C2 communications is like a cybercriminal’s version of smoke and mirrors, leaving victims and researchers alike scratching their heads.

Target Market: Energy, Oil, Gas, and Legal Sectors

In early 2025, MintsLoader decided to branch out into the energy, oil, gas, and legal sectors in the U.S. and Europe. Why? Because cybercriminals like to keep things interesting, and there’s nothing like a good phishing campaign to shake things up. By targeting industries that are often slower to adopt the latest cybersecurity measures, MintsLoader is like a digital pickpocket, slipping through the cracks and making off with valuable data. And with the added allure of fake verification pages and malicious JavaScript files, it’s clear that this malware has a flair for the dramatic.

Stage Two: The Malware Strikes Back

Once MintsLoader has wormed its way onto a victim’s machine, it doesn’t just sit back and relax. Oh no, it gets busy downloading a PowerShell script from a command-and-control server. This script is packed full of goodies, including a Base64-encoded payload that’s XOR-decoded and decompressed to reveal heavily obfuscated code. It’s like a digital treasure hunt, except the prize is a malware infection. The script also disables AMSI protections and runs a series of system checks to ensure it’s running on a genuine machine before delivering the final payload. If the system is deemed worthy, MintsLoader downloads advanced malware like GhostWeaver. If not, it might just send a decoy executable to keep things interesting.

Infrastructure Makeover: From VPS to Bulletproof Hosting

In a bid to stay one step ahead of the law, MintsLoader’s operators have switched from anonymous virtual private servers to more traditional bulletproof hosting providers. It’s like moving from a dodgy motel to a high-security fortress, giving their operations a stability boost and making life difficult for anyone trying to shut them down. With C2 servers initially on BLNWX and later expanding to ISPs like Stark Industries and SCALAXY-AS, it’s clear that MintsLoader is playing the long game. And with Russian bulletproof host Inferno Solutions in the mix, this malware is built to last.

In conclusion, MintsLoader is a force to be reckoned with in the world of cybercrime. With its multi-stage infection chain, obfuscation techniques, and penchant for targeting high-value sectors, it’s clear that this malware means business. So, whether you’re a cybersecurity expert or just someone who wants to keep their data safe, remember to watch out for those fake invoices and suspicious emails. Because in the world of MintsLoader, you never know what’s lurking behind that seemingly innocuous attachment.