A new and sophisticated malware family, dubbed 'SynkLoader' by researchers at Expel, has emerged, bringing with it a diverse set of tactics that might precede highly effective ransomware attacks. Discovered in a client's network after a July 28 deployment, SynkLoader initiates with a convincing phishing email, leveraging Microsoft 365 and Azure services to trick victims into installing a fake PowerShell system maintenance tool. This intricate malware package includes an in-memory PowerShell script, a minimalist Python environment, a malicious Python script for C2 communication, and numerous fake Microsoft runtime DLLs. Its use of Python aims to evade EDR systems, while custom DLLs enable complex Windows-native behaviors, making analysis challenging.
SynkLoader's modules include a system profiler that gathers extensive network data, suggesting an interest from ransomware groups. It also features a persistence module that bypasses conventional Task Scheduler methods by directly engaging the Windows COM interface, further evading detection. Additional capabilities include a remote access Trojan (RAT), desktop streaming with mouse and keyboard takeover, and a reverse proxy for internal network access. The most notable feature is 'PhishLocker,' a DLL-based screen locker that mimics a genuine Windows lock screen, effectively hijacking the user's display to steal system passwords. This tactic, reminiscent of older ransomware methods, is particularly potent in SSO-enabled environments where a single system password grants access to multiple company assets.
While the creators' ultimate intent remains unclear, the comprehensive and stealthy nature of SynkLoader, coupled with its advanced password theft capabilities, strongly suggests its use by ransomware groups or initial access brokers to establish a strong foothold for subsequent, more damaging attacks. Its unique approach to leveraging Python and reintroducing screen-hijacking for credential harvesting marks it as a significant threat requiring vigilant detection strategies, such as monitoring for out-of-place Python executables.
