Malware
GhostWeaver
According to TRAC Labs, the GhostWeaver backdoor not only maintains continuous, authenticated communication with its command-and-control server but also includes functionalities to generate DGA domain
GhostWeaver is a PowerShell malware family.
Background
TRAC Labs reports that the GhostWeaver backdoor keeps up continuous, authenticated contact with its command-and-control server while also being able to generate DGA domains (via a fixed-seed algorithm keyed to the week number and year), fetch further payloads through remote commands, and sidestep certificate validation using a RemoteCertificateValidationCallback hardcoded to always return true. Several of the plugins it delivers go after sensitive data, including credentials from popular browsers (Brave, Chrome, Firefox, Edge), Outlook information, and cryptocurrency wallets. Its Formgrabber plugin performs web injection by dynamically rewriting HTML content, alters JA3 fingerprints by reordering cipher suites, and sets up a man-in-the-middle proxy to capture traffic. The fact that GhostWeaver and its plugins are deployed onto machines outside of any Active Directory domain suggests the operators are reaching beyond conventional corporate victims, consistent with a financially driven focus on environments that have weaker security controls.
Source: Malpedia (Fraunhofer FKIE).