Microsoft Tracks New BazaCall Malware Campaign

Microsoft Security Intelligence is tracking an active BazaCall malware campaign that leads to ransomware deployment, officials reported in a Twitter thread yesterday.

The BazaCall campaigns use emails that instruct recipients to call a number to cancel their supposed subscription to a service. When victims call the number, they reach a fraudulent call center operated by attackers who tell them to visit a website and download an Excel file in order to cancel the service. This file contains a malicious macro that downloads the payload.

In this attack, Microsoft saw attackers using Cobalt Strike and report they stole credentials — including the Active Directory database — and exfiltrated data using rclone.

This campaign is named after BazaLoader (also called BazarLoader), the malware it initially distributed, company officials wrote. The malware is designed to provide backdoor access to an infected Windows device. With this level of access, attackers can send other forms of malware, scan the target environment, and go after other vulnerable machines on the same network.

The group behind BazaLoader uses different methods to distribute its malware. The method of using a call center emerged in early February 2021, said Brad Duncan, threat intelligence analyst for Palo Alto Networks' Unit 42, in a May blog post on the threat. He noted that phone numbers in the attackers' emails change "at least daily," and occasionally, researchers saw more than two numbers appear in a day.

Read more details on the newest campaign in Microsoft's Twitter thread.