SolarMarker is a data-stealing malware with a multi-tiered infrastructure active since 2021. Also known as Yellow Cockatoo, Polazert, and Jupyter Infostealer, it targets education, healthcare, and SMEs and uses Authenticode certificates and large zip files to evade detection. #SolarMarker #YellowCockatoo #Polazert #JupyterInfostealer
Keypoints
- SolarMarker is a data-stealing malware with a multi-tiered infrastructure active since 2021 and known by several aliases.
- It targets sectors including education, healthcare, and small & medium-sized enterprises (SMEs).
- Advanced evasion techniques are used, notably Authenticode certificates and large zip files to bypass defenses.
- The infrastructure comprises at least two clusters: a primary for active operations and a secondary likely for testing or region/industry targeting.
- Recorded Future reports a broad set of victims across multiple sectors, with data theft potentially sold on criminal forums.
- Recommended defenses include application allow-lists, security training, and regular updates to YARA/Snort rules plus network artifact analysis.
- Long-term mitigation emphasizes monitoring the cybercriminal ecosystem, policy refinement, and stronger regulatory/law enforcement actions.
MITRE Techniques
- [T1116] Code Signing – To avoid detection, it employs advanced evasion techniques like Authenticode certificates and large zip files. “To avoid detection, it employs advanced evasion techniques like Authenticode certificates and large zip files.”
- [T1560] Archive Collected Data – Uses large zip files to bypass antivirus software. “uses large zip files to bypass antivirus software.”
- [T1583] Acquire Infrastructure – The core of SolarMarkers operations is its layered infrastructure, which consists of at least two clusters: a primary one for active operations and a secondary one likely used for testing new strategies or targeting specific regions or industries. “The core of SolarMarkers operations is its layered infrastructure, which consists of at least two clusters: a primary one for active operations and a secondary one likely used for testing new strategies or targeting specific regions or industries.”
Indicators of Compromise
- [Domain] – recordedfuture.com, go.recordedfuture.com, therecord.media – references within article content and linked resources
- [File name] – insikt_group_logo_updated_3_300x48_b5390f4ff2.png, cta-2024-0513.pdf – image and PDF referenced in the article
Read more: https://www.recordedfuture.com/exploring-the-depths-of-solarmarkers-multi-tiered-infrastructure