A new intrusion campaign attributed to APT‑C‑20 (aka Fancy Bear, APT28) demonstrates the group’s continued refinement of stealthy, fileless techniques: weaponized Office documents that deploy a COM‑hijacking DLL. Extract shellcode hidden via LSB steganography in a PNG, and use reflective loading to run an obfuscated C# remote‑control Trojan that communicates through the legitimate cloud storage […]

The post Fancy Bear Uses LSB Steganography and Reflective Loading to Run C# Remote-Control Trojan appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Mayura Kathir

Source: gbHackers
Source Link: https://gbhackers.com/fancy-bear-uses-lsb-steganography/