DePriMon
The DePriMon malware is a newly uncovered downloader, which is likely the creation of a hacking group called The Lamberts (also known as Longhorn). Experts were lead to believe that the DePriMon downloader belongs to The Lamberts group because the threat would often be used in combination with a malware family that belongs to the group, and is called ColoredLambert. There are several hacking tools that belong to the ColoredLambert family – Black Lambert, White Lambert, Blue Lambert, Green Lambert, Pink Lambert, and Grey Lambert.
About The Lambert Hacking Group
The Lambert hacking group is believed to have begun operating back in 2008, but its unsafe activity did not become public until 2014. They are considered to be a very experienced hacking group with a long history of devastating cyber-attacks launched against various high-profile targets. The Lamberts group seems to concentrate most of its efforts in Europe and the Middle East. The hacking group tends to go after corporations operating in the automotive, telecommunications, and aviation industries, among other high-profile lines of business. They also are known for targeting various government institutions.
Operates Silently
The DePriMon malware has impressive abilities when it comes to remaining undetected and gaining persistence on the compromised machine. This new threat's name is based on how the malware masks itself on the infected host – Windows Default Print Monitor. Giving a threat such a generic name makes it much more difficult for the users to spot anything wrong with their systems. The DePriMon downloader works filelessly. This means that the threat operates from the memory directly, and its presence on the system is hidden with the help of reflective DLL techniques. Since the DePriMon downloader does not store its files on the disk of the infected computer, the traces of its harmful activity left on the system are reduced greatly. This makes it more difficult for anti-virus tools to detect the traces.
The DePriMon downloader is an impressive threat certainly, and The Lambert group is likely to continue using it in future campaigns.
