This new malware utilizes a rare programming language to evade traditional detection methods

Businesses should adopt more advanced monitoring and analysis methods

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

Trustwave SpiderLabs says it hasrecently uncovereda new form ofmalwareknown as Pronsis Loader, which is already causing trouble due to its unique design and tactics.

Pronsis Loader makes use of JPHP, a lesser-known programming language rarely utilized by cybercriminals, and alsoemploys advanced installation techniques, making it more challenging for cybersecurity systems to detect and mitigate.

JPHP, a variation of the popular PHP language, is rarely seen in the world of malware development. While PHP is commonly used for web applications, its integration into desktop malware development is unusual, giving Pronsis Loader an advantage in avoiding detection.

JPHP – a rare choice in cybercrime

Pronsis Loader can evade signature-based detection systems, which are typically designed to recognize more common programming languages in malware. JPHP gives the malware a layer of “stealth” allowing the malware to fly under the radar of many security tools.

The malware also uses obfuscation andencryptionmethods to hide its presence during the initial infection phase. Upon execution, it deploys complex methods to avoid triggering traditionalantivirussoftware andendpoint protectionsystems. The loader first installs itself silently in the system, disguising its activities by mimicking legitimate processes or applications, making it difficult for both automated security tools and human analysts to spot.

Once installed, Pronsis Loader can download and execute additional malware, includingransomware, spyware, or data exfiltration tools. This modular approach makes the malware highly flexible, allowing attackers to tailor the final payload based on the target’s system or environment. Pronsis Loader is part of an increasing trend in malware development where attackers use loaders as a first step in multi-stage attacks. These loaders, designed to introduce other malware into a system, provide attackers with flexibility.

To combat these evolving threats, security teams should adopt more advanced monitoring and analysis methods, such as behavior-based detection, which can identify malware by its actions rather than its code signatures alone. Additionally, continuous updates to threat intelligence can help identify the use of rare languages and methods like those employed by Pronsis Loader.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

“Pronsis Loader marks a notable shift in how cybercriminals are deploying malware, employing JPHP and silent installations to evade traditional detection methods. Its ability to deliver high-risk payloads like Lumma Stealer and Latrodectus makes it particularly dangerous,” said Shawn Kanady, Global Director of Trustwave SpiderLabs.

“Our research uncovers not only the malware’s unique capabilities but also the infrastructure that could be leveraged in future campaigns to give security teams a chance to strengthen their defences,” Kanady added.

You might also like

Efosa has been writing about technology for over 7 years, initially driven by curiosity but now fueled by a strong passion for the field. He holds both a Master’s and a PhD in sciences, which provided him with a solid foundation in analytical thinking. Efosa developed a keen interest in technology policy, specifically exploring the intersection of privacy, security, and politics. His research delves into how technological advancements influence regulatory frameworks and societal norms, particularly concerning data protection and cybersecurity. Upon joining TechRadar Pro, in addition to privacy and technology policy, he is also focused on B2B security products.

A new form of macOS malware is being used by devious North Korean hackers

Scammers are using fake copyright infringement claims to hack businesses

The 6 best electric motorcycle concepts and launches from EICMA 2024