Threats Tagged 'quartzline'

QuartzLine, also known as CLOUDHAZE, is malware disguised as a legitimate Windows PDF viewer that contains a backdoor. It has been distributed via malicious advertising campaigns, leveraging AWS S3 buckets for hosting. The malware establishes persistence through scheduled tasks and communicates with command-and-control servers. It operates with user-level privileges, allowing attackers to execute arbitrary Windows commands and deploy additional malware such as the Caira and IronBark remote access trojans. Early activity includes theft of Chrome browser data within one week of infection. The malware is signed with a now-revoked legitimate EV code-signing certificate, appearing as paperline.exe and fielddesk.exe.