Unveiling a Complex Malware Attack Campaign

Recent investigations by Cyble researchers have brought to light an intricate attack campaign that showcases advanced techniques, including obfuscation and a novel User Account Control (UAC) bypass. The primary motivation behind these attacks is to deliver a unified commodity loader, aimed at infecting systems with Remote Access Trojans (RATs) and infostealers.

Target Sectors and Geographic Focus

This particular malware campaign zeroes in on crucial sectors such as manufacturing and government organizations, predominantly in Europe and the Middle East. Countries like Italy, Finland, and Saudi Arabia stand out as primary targets. The similarities in methods across various attack strategies suggest that multiple high-capacity threat actors may be utilizing a shared framework for malware delivery.

The Objective Behind the Attack

According to the findings published in a Cyble Research and Intelligence Labs (CRIL) blog, the overarching goal of these attacks is to exfiltrate sensitive industrial data and compromise high-value administrative credentials. The campaign illustrates a concerning trend among cybercriminals who are becoming more sophisticated in their approaches.

Characteristics of the Commodity Loader

At the core of this cyberattack lies a sophisticated commodity loader that is reportedly used by numerous high-capacity threat actors. Cyble’s research indicates a remarkable uniformity in operational patterns and artifacts, suggesting a persistent architectural blueprint that serves as a common thread among various campaigns.

The CRIL team notes that despite a range of malware payloads being deployed, the mechanisms for delivery remain constant. This consistency raises alarms regarding the shared infrastructure being exploited by these actors.

Techniques Used in the Attack

The standardized methodology employed by the attackers includes advanced techniques such as:

• Steganography: Concealing payloads within seemingly innocuous image files.
• Obfuscation Techniques: Utilizing string reversal and Base64 encoding to hide harmful code.
• Advanced Process Hollowing: Abusing legitimate .NET framework executables for malicious purposes.

Researchers from Seqrite, Nextron Systems, and Zscaler have corroborated similar findings in other campaigns, emphasizing the fidelity of naming conventions and execution patterns across diverse malware operations.

Variety of Malware Delivered

The loaders are known to deploy a range of RATs and infostealers, including PureLog Stealer, Katz Stealer, DC Rat, Async Rat, and Remcos. This indicates that the loaders might either be widely shared or even sold across different groups of cybercriminals, amplifying the potential threat to organizations in the targeted regions.

Use of Obfuscation and UAC Bypass

In their investigation, Cyble documented a rich array of infection vectors, including weaponized Office documents exploiting the CVE-2017-11882 vulnerability, malicious SVG files, and ZIP archives that contain LNK shortcuts. One notable technique involves the use of a unique UAC bypass.

In this specific campaign, one instance utilized an LNK file coupled with PowerShell to download a VBS loader, alongside the UAC bypass. This method comes into play in later stages, where the malware can monitor process creation events. It cleverly triggers a UAC prompt when a new process starts, misleading the system or user into granting elevated privileges. This manipulation allows the malware to execute PowerShell commands with elevated rights following user approval.

Evolution of Cyber Threats

The emergence of a novel UAC bypass technique indicates that this malware campaign is continually evolving, backed by a dedicated development cycle. Organizations, particularly those residing in these targeted sectors, should approach seemingly harmless image files and email attachments with elevated caution.

Phishing attempts typically dressed as standard Purchase Order communications initiate the campaign. Malicious image files are hosted on legitimate platforms, inserting steganographically hidden payloads to evade traditional file-based detection systems.

Advanced Techniques for Evasion

Threat actors implement sophisticated “hybrid assembly” strategies to “trojanize” trusted open-source libraries by appending malicious functionalities and recompiling them. This makes it exceptionally challenging for signature-based detection methods to identify these threats.

The entire infection chain is meticulously designed to minimize forensic traces, employing techniques such as script obfuscation, steganographic extraction, reflective loading that allows code to run directly in memory, and process injection to conceal malicious activities amidst genuine system processes.

For those interested, a more detailed examination of a specific malware sample can be found in Cyble’s blog, which also explores relevant MITRE tactics, techniques, and procedures (TTPs), along with Indicators of Compromise (IoCs).

By understanding these evolving techniques and methodologies, organizations can better protect themselves from the increasing complexity of cyber threats in today’s digital landscape.