Threat video1:00
SolarMarker On-Device Fraud via VNC: Detection & IOCs
SolarMarker runs on-device fraud through an injected custom VNC client: 22 IOCs and 9 detection rules, plus a free Splunk SPL rule.
Read the full threat intel for SolarMarker On-Device Fraud via VNC: Detection & IOCs →
Chapters
- 0:00The hookSolarMarker's 6 modules enabled on-device fraud.
- 0:04The storySince July 2020, it injected VNC.
- 0:11Attack pathSearch poisoning led to fake installer.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise16 indicators to hunt: 5 IPs, 2 domains and 1 URL, and more.
- 0:36MITRE ATT&CK techniques18 ATT&CK techniques, from resource development to impact.
- 0:41Remediation4 steps now: Hunt for SearchIndexer.exe or GamePanel.exe instances launching browsers or acting.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00SolarMarker's 6 modules enabled on-device fraud.
0:05Since July 2020, it injected VNC.
0:08Hands-on fraud on 6 accounts.
0:11Search poisoning led to fake installer.
0:14Mars backdoor took control via C2.
0:17VNC injected into system processes.
0:20Chrome session stolen; accessed 6 accounts.
0:25No threat actor is attributed. Confidence: low.
0:3016 indicators to hunt: 5 IPs, 2 domains and 1 URL, and more.
0:3718 ATT&CK techniques, from resource development to impact.
0:414 steps now: Hunt for SearchIndexer.exe or GamePanel.exe instances launching browsers or acting.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.