Elastic Security uncovers BLISTER malware campaign

Elastic Security uncovered a stealthy malware campaign using a novel loader called BLISTER that leverages legitimately issued code-signing certificates and DLL splicing to evade detection; BLISTER decodes and executes embedded payloads (observed CobaltStrike and BitRAT) in-memory, injects or spawns WerFault.exe, and establishes persistence via copied files and startup/run keys. The report provides YARA rules, IoCs (hashes, domains, IPs), MITRE ATT&CK mappings, hunting queries, and defensive recommendations for detection and prevention.