Hackers Target Windows Tool to Deploy Crypto-Mining Malware

Hackers have been leveraging a Windows tool to deploy cryptocurrency-mining malware since November 2021, according to an analysis from Cisco’s Talos Intelligence. The attackers exploit Windows Advanced Installer, a tool designed to assist developers in packaging other software installers, like Adobe Illustrator, to execute malicious scripts on compromised machines.

A blog post from September 7 reveals that the software installers targeted in this attack are primarily associated with 3D modeling and graphic design. Furthermore, most of the malicious software installers identified in the campaign are written in French. The analysis indicates that the victims are likely spread across various business sectors, including architecture, engineering, construction, manufacturing, and entertainment in countries where French is predominantly spoken.

An example highlighted in the analysis shows how a software installer can be packaged with malicious scripts using Advanced Installer.