DarkCloud Stealer has recently emerged as a potent threat targeting financial organizations through convincing phishing campaigns. Adversaries employ weaponized RAR attachments masquerading as legitimate documents to deliver a multi-stage JavaScript-based payload.

Upon opening the archive, victims execute a VBE script that leverages Windows Script Host to initiate a PowerShell downloader hidden in innocuous-seeming image files.

This initial access vector exploits users’ trust in routine financial correspondence, triggering an automated chain of decoding and decryption steps designed to evade conventional security controls.

In early September 2025, security teams observed a dramatic uptick in malicious RAR attachments sent to corporate email accounts within the banking sector.

CyberProof analysts identified that the archive named “Proof of Payment.rar” contains a VBE script which, when executed, calls PowerShell to download an embedded JPG file named universe-1733359315202-8750.jpg.

The stealer’s loader is concealed within this image, and the decoding routine extracts the .NET DLL module directly from image pixel data.

CyberProof researchers noted that the PowerShell script rigorously checks memory offsets to locate a distinct BMP header pattern before carving out the loader DLL.

The following snippet illustrates the core loop used for scanning the downloaded image bytes:-

for ($i=0; $i -lt $data.Length - $header. Length; $i++) {
    $match = $true
    for ($j=0; $j -lt $header.Length; $j++) {
        if ($data[$i + $j] -ne $header[$j]) { $match = $false; break }
    }
    if ($match) { $offset = $i; break }
}

Once the DLL is reconstructed in memory, the script invokes [Reflection.Assembly]::Load() to execute the loader without ever touching disk.

Persistence and Credential Theft

After loading into memory, DarkCloud Stealer establishes persistence by copying a JavaScript payload to the Windows Run registry key under a disguised filename (M3hd0pf.exe masquerading as MSBuild.exe), ensuring execution on every user login.

The stealer then injects into legitimate processes like MSBuild.exe and mtstocom.exe using process hollowing techniques, enabling it to siphon saved credentials from browser databases such as Chrome’s Login Data.

Alerts from endpoint detection platforms confirm DPAPI access events and memory mapping into browser processes, revealing attempts to decrypt stored passwords directly in memory.

Finally, stolen data is staged in user directories and exfiltrated via FTP and HTTP channels to dynamic domain clusters (.shop, .xyz), complicating network-based detection.

Financial institutions are urged to monitor for anomalous VBE/VBS execution, unexpected registry Run key modifications, and JavaScript files in public download folders to rapidly detect and disrupt this insidious campaign.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post DarkCloud Stealer Attacking Financial Companies With Weaponized RAR Attachments appeared first on Cyber Security News.

Emerging in early September 2025, the Yurei ransomware has swiftly drawn attention for its novel combination of Go-based execution and ChaCha20 encryption.

First documented on September 5 when a Sri Lankan food manufacturer fell victim, the threat actor behind Yurei adopted a double-extortion model: encrypting files while exfiltrating sensitive data for additional leverage.

Within days, two more victims in India and Nigeria were publicly listed, underscoring the operator’s rapid expansion.

Unlike many sophisticated groups that develop custom toolsets, Yurei’s codebase traces back to the open-source Prince-Ransomware project, raising questions about the skill level and resources of the attackers.

At its core, Yurei leverages Go’s concurrency features to enumerate all drives in parallel and encrypt files with the ChaCha20 algorithm.

For each file, a new random ChaCha20 key and nonce are generated, then encrypted using ECIES with the attacker’s public key.

The resulting ciphertext, key, and nonce are concatenated with delimiters:-

// Generate random key and nonce
key := generateChaCha20Key()
nonce := generateNonce()
// Encrypt file content
encryptedData := chaCha20Encrypt(content, key, nonce)
// Protect key and nonce with ECIES
protectedKey := eciesEncrypt(key, publicKey)
protectedNonce := eciesEncrypt(nonce, publicKey)
// Store encrypted file
store := protectedKey + "||" + protectedNonce + "||" + encryptedData

Check Point researchers noted that Yurei retains symbols in the binary, a mistake inherited from the Prince-Ransomware builder, which did not strip debugging information.

This oversight provided analysts with clear function names such as Yurei_encryption_generateKey and Yurei_filewalker_EncryptAllDrivesAndNetwork, streamlining the reverse-engineering process.

Shadow Copy Recovery and Defensive Implications

Despite this, Yurei’s use of Go complicates detection for some legacy antivirus products, illustrating how language choice can impact defensive measures.

Following successful encryption, Yurei attempts to set a custom wallpaper via PowerShell, though the absence of a valid URL causes the command to fail, resulting in a blank background.

The embedded PowerShell snippet mirrors that of its Prince-Ransomware predecessor:-

(New-Object System.Net.WebClient).DownloadFile('<WallpaperURL>', "$env:TEMP\Wallpaper.png")
Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;
public class Wallpaper {
    [DllImport("user32.dll", CharSet=CharSet.Auto)]
    public static extern bool SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);
}
"@
[Wallpaper]::SystemParametersInfo(20, 0, "$env:TEMP\Wallpaper.png", 3)

In the context of defensive strategies, Yurei’s failure to remove Volume Shadow Copies reveals a critical weakness.

Organizations with VSS enabled can recover files without paying ransom, although leaked data remains at risk.

The combination of rapid encryption, data exfiltration, and half-baked persistence techniques reflects a low-effort but effective operation.

As Yurei continues targeting diverse sectors, security teams are urged to monitor for the distinct file extension .Yurei, enforce strict egress controls, and validate VSS snapshots to mitigate the impact of this emerging threat.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post New Yurei Ransomware With PowerShell Commands Encrypts Files With ChaCha20 Algorithm appeared first on Cyber Security News.