SLUB Malware

The SLUB Malware is a backdoor Trojan that can let attackers control the infected PC by issuing system commands, offering remote management via third-party platforms like GitHub and exfiltrating system information. Users should guard against possible attacks using browser-based watering hole strategies and remove the SLUB Malware through trusted PC security solutions.

A Backdoor Takes Good Web Services for Granted

The hijacking of programmer and business managerial tools makes for cheap replacements for a more traditional Command & Control server setup. The SLUB Malware's evolving techniques in this respect offer a glimpse into how competent Black Hat programmers can use free Web resources as ways of organizing and administering attacks against innocent PC users. Its novelties of server communications aside, the SLUB Malware also makes a clear example of the average backdoor Trojan.

The SLUB Malware's name, a fusion of Slack and GitHub, refers to its C&C networking features, which, in different versions, utilize either of those platforms for letting attackers control the victim's computer. However, more recent releases that target traffic for the Korean American National Coordinating Council's website substitute Mattermost, possibly to lower the risk of third parties interfering with the attackers' makeshift servers. Through these websites, the SLUB Malware's admins monitor infections by various user accounts and transfer commands to the Trojan.

The use of 'safe' sites for C&C infrastructure isn't a first for the SLUB Malware or the overall threat landscape. Threat actors may make this design choice for evading detection from network-monitoring tools and other security solutions that flag unexpected contact with corrupted or unauthorized domains. The SLUB Malware shows similar caution in its distribution methods, which use watering-hole techniques for niche Web traffic targets like the previously-mentioned KANCC instead of attacking the general public.

A Backdoor into Your Computer Well Worth Shutting

The SLUB Malware can execute the usual commands from attackers, such as running an executable or downloading a file. Due to the high risk of attacker-based system control, users should respond to infections by disabling network connectivity as soon as possible. In the more current cases, the SLUB Malware also has 'wingman' support in the form of other Trojans with more specialized features: dneSpy and agfSpy, which are more backdoor Trojans.

Many drive-by-downloads for the SLUB Malware exploit different software vulnerabilities for infecting Windows computers. These attacks can breach most well-used browsers like Chrome or Internet Explorer through methods such as the old CVE-2016-0189 or the new CVE-2020-0674. When possible, patching software will remove many vulnerabilities, and malware experts also encourage disabling possibly-risky features like JavaScript and Flash when Web-surfing.

PC security vendors' products should counterattack these exploits and block the installation attempts, although removing the SLUB Malware post-infection also should be executed without any interference from attackers.

The SLUB Malware is a custom-coded C++ program that does a great deal of harm with services meant for workplace and project organization. On the Web, as with other areas of life, a single bad actor can ruin something nice for everyone faster than most might think.