Our Malware Lab conducted a priority analysis on a new malware distribution vector targeting users of Blenderby exploiting the inclusion of Python scripts within Blender project files.
Attention was initially raised by a report published in the Blender subreddit. After contacting the author of the post, it was possible to acquire a sample of the file involved, which was allegedly disseminated via Fiverr, one of the main platforms for freelance work.
The analysis revealed a sophisticated, multi-stage attack chain, which exploits Blender's default 'Auto Run Python Scripts' enabled functionality to distribute and execute malware, and as the initial infection vector a 3D model of Blender seemingly harmless.
A preliminary search showed that there were no references to the file in VirusTotal's databases, nor were there any detections by the main antivirus engines.
Although similar reports have surfaced in the past, to date there has been a lack of technical analysis that fully reconstructs the attack chain associated with compromised Blender files. For this reason, the analysis and drafting of this report was given top priority by the team, with the aim of filling an information gap and providing the technical and scientific community with timely input.
If you wish to learn more, here is the link to our full report.
In addition, you can subscribe to the specific mailing list Cyber Studios by Tinexta Defence, to receive updates on upcoming research: https://tinextadefence.it/mailing-list-cyber-studios/
