How to hack whatsapp And how to prevent from being hacked

New Malware Uses Windows BITS Service to Stealthy Exfiltrate Data

 Cybersecurity researchers have discovered a new computer virus associated with the Stealth Falcon state-sponsored cyber espionage group that abuses a built-in component of the Microsoft Windows operating system to stealthily exfiltrate stolen data to attacker-controlled server.

Active since 2012, Stealth Falcon is a sophisticated hacking group known for targeting journalists, activists, and dissidents with spyware in the Middle East, primarily in the United Arab Emirates (UAE).

Dubbed Win32/StealthFalcon, named after the hacking group, the malware communicates and sends collected data to its remote command-and-control (C&C) servers using Windows Background Intelligent Transfer Service (BITS).

 

BITS is a communication protocol in Windows that takes unused network bandwidth to facilitate asynchronous, prioritized, and throttled transfer of files between machines in the foreground or background, without impacting the network experience.

BITS is commonly used by software updaters, including downloading files from the Microsoft servers or peers to install updates on Windows 10, messengers, and other applications designed to operate in the background.

According to security researchers at cyber-security firm ESET, since BITS tasks are more likely permitted by host-based firewalls and the functionality automatically adjusts the data transfer rate, it allows malware to stealthily operate in the background without raising any red flags. 

After successfully exfiltrating the stolen data, the malware automatically deletes all log and collected files after rewriting them with random data in order to prevent forensic analysis and recovery of the deleted data.

As explained in the report, Win32/StealthFalcon backdoor has not only been designed to steal data from the compromised systems but can also be used by attackers to further deploy more malicious tools and update its configuration by sending commands through C&C server.