OilRig APT Drills into Malware Innovation with Unique Backdoor

mood · Jul 23, 2020

OilRig APT Drills into Malware Innovation with Unique Backdoor
July 22, 2020
https://threatpost.com/oilrig-apt-unique-backdoor/157646/

A series of cyberattacks on a telecom company in the Middle East has signaled the return of the OilRig APT. The attacks also revealed a revised backdoor tool in the group’s arsenal, called RDAT.

The attacks were observed in April by Palo Alto Networks’ Unit 42. Researchers there said that the version of RDAT in question was uncovered during the course of its investigation, standing out by using a unique command-and-control (C2) channel. To wit, it uses steganography to hide commands and data within bitmap images attached to emails.

“In June 2018, the developer of RDAT added the ability to use Exchange Web Services (EWS) to send and receive emails for C2 communications,” according to Unit 42’s report, issued Wednesday.
Along with RDAT, OilRig in the telecom campaign used custom Mimikatz tools for collecting credentials, Bitvise to create SSH tunnels and PowerShell downloaders to perform post-exploitation activities.
Click to expand...

The Novel C2 Channel
RDAT communicates with two hardcoded actor-controlled email addresses: koko@acrlee[.]com and h76y@acrlee[.]com. It simply sends email to the actor-controlled email addresses, attaching Bitmap images that contain hidden messages or data to exfiltrate.
Click to expand...

Palo Alto Networks - Unit42: OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory

While analyzing an attack against a Middle Eastern telecommunications organization, we discovered a variant of an OilRig-associated tool we call RDAT using a novel email-based command and control (C2) channel that relied on a technique known as steganography to hide commands and data within bitmap images attached to emails.
Click to expand...

Log in or Sign up

OilRig APT Drills into Malware Innovation with Unique Backdoor

mood Updates Team