The Rising Threat of ZenRAT: An Infiltration Journey Disguised as a Password Manager Tool

A Novel Info-Stealing Malware Targets Bitwarden Password Manager Users

Introduction

A new strain of info-stealing malware, dubbed ZenRAT, is specifically targeting Windows users through fake installation packages of the popular open-source password manager Bitwarden. The attack involves a fake website that distributes the malware-laden packages. The discovery was made by researcher Jérôme Segura of Malwarebytes, who shared a sample of the malware with researchers at Proofpoint. The researchers detailed their findings in a blog post, highlighting the elaborate nature of the scheme and the lengths taken to ensure that the malware targets only Windows users.

The Elaborate Scheme

The malicious packages are distributed through a fake website, bitwariden[.]com, which closely resembles the legitimate Bitwarden website. Non-Windows users attempting to access the domain are redirected to a cloned article about the password manager, while Windows users clicking on download links for Linux or MacOS are redirected to the legitimate Bitwarden site, vault.bitwarden.com.

The researchers reported that it is still unclear how users reach the fake Bitwarden site initially, but they speculated that historic activities such as fake software installers may have been delivered through SEO poisoning, adware bundles, or email campaigns.

Malware Functionality

Once a Windows user clicks to install the fake package, a .NET executable named ZenRAT is downloaded. The malware includes modules that perform Remote Access Trojan (RAT) functions, such as system-fingerprinting, collecting installed-applications data, and stealing passwords and other information from browsers. This stolen information is then sent back to the attackers via a command-and-control server.

After infecting a system, the malware copies itself to a temporary directory and creates a hidden file that initiates a self-deletion loop for both itself and the installer file. The malware also places an executable file in a separate directory and runs it, effectively launching ZenRAT. Interestingly, the malware claims to be a different application in its file properties, possibly as an evasion mechanism.

Targeting Password Managers

This is not the first time that threat actors have targeted password managers like Bitwarden for malicious activities. In the past, campaigns have utilized paid ads to redirect users to credential-stealing phishing sites in response to searches for Bitwarden and other password management technologies. LastPass, one of the largest players in the password manager space, has also been breached in previous attacks.

Advice for Users

Given that malware is often delivered through files masquerading as legitimate application installers, it is crucial for end users to only download software directly from trusted sources. Users should verify the domains hosting software downloads against the official website to ensure the install package is legitimate and not hosted by a malicious site.

Additionally, users should be cautious of ads in search engine results, as they have been a major driver of infections in recent years. Vigilance is essential in safeguarding against cybersecurity threats, and users should prioritize their online security by following best practices and adopting a proactive approach in identifying and mitigating potential risks.

Conclusion

The discovery of the ZenRAT malware targeting Bitwarden users highlights the continuous efforts by threat actors to exploit software vulnerabilities and user trust. As technology advances, so do the tactics employed by cybercriminals. It is imperative for users to remain vigilant, ensure software downloads from trusted sources, and stay informed about evolving cybersecurity threats.