SoupDealer Malware Bypasses Every Sandbox, AV's and EDR/XDR in Real-World Incidents

SoupDealer Malware Bypasses Every Sandbox, AV's and EDR/XDR in Real-World Incidents

submitted by

https://cybersecuritynews.com/soupdealer-malware-bypasses-every-sandbox/

8
34

Log in to comment

Hot Top New Old

In live incidents, SoupDealer bypassed host‐based antivirus checks by confirming no security products were active before proceeding.

That's a pretty narrow victim demographic. Windows has Defender enabled out of the box. I don't see any investigation on the C2 connection, either, so I'm left wondering who the attacked and intended targets are.

 reply
15

And it downloads Tor to connect to C2. So it's a machine with Internet access AND without security mesures.

So it might be a target with poor IT. A windows machine shouldn't be left without AV, especially if it has Internet access.

 reply
2

Why would somebody only target machines in Turkey?

 reply
5

Greece has entered the chat

 reply
5

oh wait. yeah, look I'm not a smart man

 reply
5

I'm a smart man and I think your question still stands. Why shouldn't they get along like normal people. (Intentionally no question mark.)

 reply
5
[deleted]

Yikes 😬

 reply
4
Insert image