Microsoft has introduced a "fairly major" update to its Malicious Software Removal Tool to detect and kill infections of the insidious and constantly morphing data-stealing malware family known as Zbot, or Zeus. Since the software giant first added detection for Zeus last October, hundreds of thousands of Windows PCs have been expunged of the threat, prominent in banking and e-commerce fraud. But as Zeus, which recently merged code bases with SpyEye, continues to acquire advanced evasion capabilities, Microsoft has had to fight "sneakiness with sneakiness," according to a blog post on Wednesday. The company introduced the update as part of its monthly security patches, released on Tuesday.
Aside from utilizing junk code and conducting metamorphic transformations, BabbleLoader also exploits a plethora of other techniques, including unique control flow and encryption, to conceal malicious activities from traditional and artificial intelligence-based detection systems, according to an Intezer analysis.
More severe of the two issues — both of which have been discovered and reported by TZL security researchers during the Matrix Cup hacking competition in China — is the critical remote code execution flaw, tracked as CVE-2024-38812, which stems from a vCenter DCE/RPC protocol heap overflow issue.