ObliqueRAT linked to threat group launching attacks against government targets

guest · Feb 21, 2020

ObliqueRAT linked to threat group launching attacks against government targets
The new Trojan is attacking organizations across Southeast Asia
February 21, 2020
https://www.zdnet.com/article/new-o...crimsonrat-group-striking-government-targets/

Researchers have uncovered a new Remote Access Trojan (RAT) that appears to be the handiwork of a threat group specializing in attacks against government and diplomatic targets.

On Thursday, Cisco Talos researchers said the malware, dubbed ObliqueRAT, is being deployed in a new campaign focused on targets in Southeast Asia.
Password protection is in place, a technique that may be designed to try to make the documents appear legitimate and secure in corporate settings.

If the victim inputs the password and opens the document, a malicious VB script springs into action, extracting a malicious binary and dropping an executable which acts as the dropper for ObliqueRAT.
Click to expand...

An interesting feature, however, is that the malware seeks out a particular directory in order to grab files residing within. The directory name, C:\ProgramData\System\Dump, is hardcoded.
According to Talos, similarities between how the RAT is being spread and within the VBA script variables used in the malicious documents suggest a potential link to CrimsonRAT [...]
Click to expand...

Cisco Talos: ObliqueRAT: New RAT hits victims' endpoints via malicious documents

Log in or Sign up

ObliqueRAT linked to threat group launching attacks against government targets

guest Guest

Log in or Sign up

ObliqueRAT linked to threat group launching attacks against government targets

guest Guest

Useful Searches