Anomali Cyber Watch: Costa Rica in Ransomware Emergency, Charming Kitten Spy and Ransom, Saitama Backdoor Hides by Sleeping, and More

| | | |

(published: May 12, 2022)

Morphisec researchers discovered a new campaign abusing popular messaging platform Discord content distribution network (CDN). If a targeted user activates the phishing attachment, it starts the DNetLoader malware that reaches out to the hardcoded Discord CDN link and downloads a next stage crypter such as newly-discovered SYK crypter. SYK crypter is being loaded into memory where it decrypts its configuration and the next stage payload using hardcoded keys and various encryption methods. It detects and impairs antivirus solutions and checks for debugging environment, achieves persistence through startup folder, and runs the payload using process hollowing technique. For final payloads the actors used the RedLine stealer and various remote access trojans: AsyncRAT, NanoCore RAT, njRAT, QuasarRAT, and WarzoneRAT.
Analyst Comment: As threat actors increasingly abuse popular cloud services, it is not always feasible to block all their staging domains. Organizations need to implement layered defenses starting from phishing awareness and finishing with network segmentation.
MITRE ATT&CK: | |

(published: May 11, 2022)

Bitter (T-APT-17), is a group suspected of being sponsored by the Indian government. Since 2013, Bitter targeted China, Pakistan, and Saudi Arabia. From August 2021 to at least February 2022, their new cyberespionage campaign targeted the government of Bangladesh with spearphishing emails impersonating Pakistani officials. Upon a user opening the attached maldoc, the Equation Editor application is launched to run the embedded objects with shellcode to exploit known Microsoft Office vulnerabilities. It allows the attackers to download and execute their custom Trojan-downloader that Cisco Talos researchers called ZxxZ for the string common in its command-and-control (C2) communication.
Analyst Comment: The impersonation of government agencies continues to be an effective spearphishing tactic. All users should be informed of the threat phishing poses, and how to safely make use of email. Email attachments should be treated as untrusted regardless of the sender's credibility. Detection and prevention measures should be taken to ensure that users do not fall victim to phishing.
MITRE ATT&CK: | |

(published: May 11, 2022)

Proofpoint researchers describe Nerbian RAT, a new malware written in the Go programming language. It was spreading via malicious email campaigns using COVID-19 lures impersonating the World Health Organization (WHO). Nerbian reuses multiple open-source libraries, it reaches out to Github code of Chacal, a Golang anti-virtual-machine framework designed to make debugging and reverse engineering more difficult. It stops if the size of the hard disk is too small or certain functions take too long to execute, and if it detects certain MAC addresses, processes, and strings in the disk name. Nerbian RAT has additional checks not provided by Chacal that query network interface names and if the executable is being debugged.
Analyst Comment: Defenders should monitor for strings referring to offensive GitHub repositories such as Chacal. Many advanced attacks start with basic techniques such as unwarranted email with malicious attachment that requires the user to open it and enable macroses. It is important to teach your users basic online hygiene and phishing awareness.
MITRE ATT&CK: | | | |

(published: May 10, 2022)

Checkpoint researchers discovered a years-long phishing campaign that targeted German companies in the automotive industry. In February 2021, the actor behind this campaign started registering typosquatted domains. From July 2021 to mid-March 2022, phishing emails were sent enticing users to open attached ISO files and then the dropped .HTA (HTML Applications) file. The final payload was one of the various MaaS (Malware as a Service) info-stealers: AZORult, BitRAT, or Raccoon.
Analyst Comment: Employees should be trained to report suspicious emails to IT. Network defenders advised to configure a system to explode suspicious emails in a sandbox environment, for example, as provided by Anomali XDR (ThreatStream). Anomali Targeted Threat Monitoring service reports newly registered typosquatted domains which then can be blocked through Email Security Solution using Anomali Integrator to help you protect from such targeted phishing attacks.
MITRE ATT&CK: | |

(published: May 10, 2022)

On April 26, 2022, Iran-sponsored actor Helix Kitten (OilRig, APT34) targeted Jordan’s foreign ministry with a phishing attachment dropping a new backdoor named Saitama. The backdoor is written in .Net and communicates via DNS protocol. Saitama command-and-control (C2) includes hardcoded domains with subdomains generated using the Mersenne Twister pseudorandom number generator (PRNG). The backdoor also has a hardcoded list of possible command-line commands that include internal IP and domain addresses, showing the highly-targeted nature of the attack and some previous knowledge about the victim’s internal infrastructure. Saitama is implemented as a finite-state machine meaning it will change its state depending on the command sent to every state. For example, unsuccessful DNS requests puts the backdoor in sleep mode for a time between 6 and 8 hours, and Saitama has ​​different sleep time for every situation.
Analyst Comment: Defense-in-depth is an effective way to help mitigate potential advanced persistent threat (APT) activity. Defense-in-depth involves the layering of defense mechanisms. This can include network and end-point security, social engineering training (such as training exercises to help detect phishing emails) for staff and robust threat intelligence capabilities.
MITRE ATT&CK: | | | |

(published: May 9, 2022)

The Costa Rican President has declared a national emergency following cyber attacks from Conti ransomware group (threat actor Wizard Spider) on multiple government bodies. The country was cripled since the April 2022 attack and denying the ransom demand, its Treasury IT systems has been down for three weeks. Additionally, Conti started publishing the 672 GB dump of the data stolen from the Costa Rican government agencies. As Conti threatens many US organizations as well, the US Department of State has offered a multimillion-dollar reward for information to bring Conti co-conspirators to justice.
Analyst Comment: Cleaning up after ransomware attacks involves restoration of backup data and IT systems, often purchasing at least some new equipment. A thorough investigation needed regarding the potential of abuse of leaked data in the future impersonation/phishing attacks.
MITRE ATT&CK:
Tags: Conti, BazarLoader, Wizard Spider, Conti ransomware group, TrickBot, Conti ransomware, Ryuk, Government, Financial, Costa Rica, target-country:CR, Russia, Social Security

| | | | | | | | |
Tags: DCRat, DCRat Stealer, Windows, JPHP, DevelNext, PHP, JVM, .NET, Dark Crystal RAT, DCRat Studio, DarkCrystal RAT, boldenis44, crystalcoder, DarkCrystalRAT, DCRatSeller_bot, Russia, source-country:RU