Dark Caracal APT Once Again Targets Multiple Sectors with Digitally Signed Bandook Malware

guest · Nov 27, 2020

Digitally Signed Bandook Malware Once Again Targets Multiple Sectors
November 27, 2020
https://thehackernews.com/2020/11/digitally-signed-bandook-malware-once.html

A cyberespionage group with suspected ties to the Kazakh and Lebanese governments has unleashed a new wave of attacks against a multitude of industries with a retooled version of a 13-year-old backdoor Trojan.

Check Point Research called out hackers affiliated with a group named Dark Caracal in a new report published yesterday for their efforts to deploy "dozens of digitally signed variants" of the Bandook Windows Trojan over the past year, thus once again "reigniting interest in this old malware family."
Click to expand...

The different verticals singled out by the threat actor include government, financial, energy, food industry, healthcare, education, IT, and legal institutions located in Chile, Cyprus, Germany, Indonesia, Italy, Singapore, Switzerland, Turkey, and the US.

But according to the cybersecurity firm, the new variant of Bandook is a slimmed-down version of the malware with support for only 11 commands, while prior versions were known to feature as many as 120 commands, suggesting the operators' desire to reduce the malware's footprint and evade detection against high-profile targets.
Click to expand...

Not only valid certificates issued by Certum were used to sign this trimmed version of the malware executable, Check Point researchers uncovered two more samples — full-fledged digitally-signed and unsigned variants — which they believe are operated and sold by a single entity.
Click to expand...

Check Point Research: Bandook: Signed & Delivered

Check Point Research recently observed a new wave of campaigns against various targets worldwide that utilizes a strain of a 13-year old backdoor Trojan named Bandook.

Bandook, which had almost disappeared from the threat landscape, was featured in 2015 and 2017 campaigns, dubbed “Operation Manul” and “Dark Caracal“, respectively. These campaigns were presumed to be carried out by the Kazakh and the Lebanese governments, as uncovered by the Electronic Frontier Foundation (EFF) and Lookout.
During this past year, dozens of digitally signed variants of this once commodity malware started to reappear in the threat landscape, reigniting interest in this old malware family.
Click to expand...

Log in or Sign up

Dark Caracal APT Once Again Targets Multiple Sectors with Digitally Signed Bandook Malware

guest Guest

Log in or Sign up

Dark Caracal APT Once Again Targets Multiple Sectors with Digitally Signed Bandook Malware

guest Guest

Useful Searches