Researchers Identify New Malware Loader Variant

JSSLoader was first identified by Proofpoint researchers in 2019 as it was being spread by attackers as part of an email campaign. The malware was often dropped as a first- or second-stage malware to target victims. The strain had been inactive since May, Proofpoint says in a new report. The malware apparently has make a comeback with some changes, which include being compiled in C++ programming language rather than .NET, researchers say. “The campaigns are ongoing and use similar lures to those initially observed by Proofpoint researchers in 2019,” typically focusing on invoices and package delivery information, the report notes. The campaigns have attempted to target hundreds of organizations across a wide range of industries, including finance, manufacturing, technology, retail, healthcare, education and transportation, Proofpoint says.