Attackers adopt JavaScript runtime Bun to spread NWHStealer

The article from Malwarebytes discusses how attackers are using a new JavaScript runtime called Bun to spread NWHStealer, a type of malware that steals sensitive information from compromised systems. Here's a summary of the key points:

Key Points:

1. Use of Bun Runtime:

   • Attackers are leveraging Bun, a modern JavaScript runtime, to distribute NWHStealer.
   • This approach allows them to utilize advanced features and libraries available in Bun for their malicious activities.

2. Malware Distribution Tactics:

   • The malware is distributed through various means, including fake software updates or cracked versions of legitimate applications.
   • Attackers often use social engineering tactics to trick users into downloading these compromised files.

3. C2 Communication:

   • NWHStealer communicates with its command and control (C2) servers to receive instructions and exfiltrate stolen data.
   • The C2 server URLs mentioned in the article include whale-ether.pro, cosmic-nebula.cc, and others.

4. Encryption and Decryption:

   • The malware uses AES encryption for secure communication with its C2 server.
   • It obtains an AES key from the C2 server to decrypt

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.