[Trend]Waterbear is Back, Uses API Hooking to Evade Security Product Detection

[igor51]

Waterbear is Back, Uses API Hooking to Evade Security Product Detection

In one of its recent campaigns, we’ve discovered a piece of Waterbear payload with a brand-new purpose: hiding its network behaviors from a specific security product by API hooking techniques. In our analysis, we have discovered that the security vendor is APAC-based, which is consistent with BlackTech’s targeted countries. 

The post Waterbear is Back, Uses API Hooking to Evade Security Product Detection appeared first on .

Source: Waterbear is Back, Uses API Hooking to Evade Security Product Detection