OceanLotus APT Uses New Ratsnif Trojan for Network Attacks

guest · Jul 1, 2019

OceanLotus APT Uses New Ratsnif Trojan for Network Attacks
July 1, 2019
https://www.bleepingcomputer.com/ne...-uses-new-ratsnif-trojan-for-network-attacks/

A fairly undetected remote access trojan called Ratsnif and used in cyber-espionage campaigns from the OceanLotus group has gained new capabilities that allow it to modify web pages and SSL hijacking.

Researchers at Blackberry Cylance analyzed four variants of the Ratsnif RAT family that show it evolve from a debug build to a release version with features like packet sniffing, ARP poisoning, DNS and MAC spoofing, HTTP redirection and injection, SSL hijacking, and setting up remote shell access.

"Unlike the 2016 variants of Ratsnif that stored all packets to a PCAP file, the 2018 variant employs multiple sniffer classes for harvesting sensitive information from packets. This will minimize the amount of data the attacker has to collect, exfiltrate and process, and also reveals what information the attacker is interested in," reads the analysis.
Click to expand...

Cylance experts conclude that Ratsnif is an intriguing discovery because it managed to stay under the radar for so long; an explanation could be its limited deployment.
However, after two years of apparent development, the effort failed to deliver a good quality product. "Simply put, Ratsnif does not meet the usual high standards observed in OceanLotus malware," state the researchers.
Click to expand...

Log in or Sign up

OceanLotus APT Uses New Ratsnif Trojan for Network Attacks

guest Guest

Log in or Sign up

OceanLotus APT Uses New Ratsnif Trojan for Network Attacks

guest Guest

Useful Searches