OilRig APT Drills into Malware Innovation with Unique Backdoor

guest · Jul 23, 2020

OilRig APT Drills into Malware Innovation with Unique Backdoor
July 22, 2020
https://threatpost.com/oilrig-apt-unique-backdoor/157646/

A series of cyberattacks on a telecom company in the Middle East has signaled the return of the OilRig APT. The attacks also revealed a revised backdoor tool in the group’s arsenal, called RDAT.

The attacks were observed in April by Palo Alto Networks’ Unit 42. Researchers there said that the version of RDAT in question was uncovered during the course of its investigation, standing out by using a unique command-and-control (C2) channel. To wit, it uses steganography to hide commands and data within bitmap images attached to emails.

“In June 2018, the developer of RDAT added the ability to use Exchange Web Services (EWS) to send and receive emails for C2 communications,” according to Unit 42’s report, issued Wednesday.
Along with RDAT, OilRig in the telecom campaign used custom Mimikatz tools for collecting credentials, Bitvise to create SSH tunnels and PowerShell downloaders to perform post-exploitation activities.
Click to expand...

The Novel C2 Channel
RDAT communicates with two hardcoded actor-controlled email addresses: koko@acrlee[.]com and h76y@acrlee[.]com. It simply sends email to the actor-controlled email addresses, attaching Bitmap images that contain hidden messages or data to exfiltrate.
Click to expand...

Palo Alto Networks - Unit42: OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory

While analyzing an attack against a Middle Eastern telecommunications organization, we discovered a variant of an OilRig-associated tool we call RDAT using a novel email-based command and control (C2) channel that relied on a technique known as steganography to hide commands and data within bitmap images attached to emails.
Click to expand...

guest · Feb 3, 2023

Iranian OilRig Hackers Using New Backdoor to Exfiltrate Data from Govt. Organizations
By Ravie Lakshmanan - February 3, 2023

The Iranian nation-state hacking group known as OilRig has continued to target government organizations in the Middle East as part of a cyber espionage campaign that leverages a new backdoor to exfiltrate data.

"The campaign abuses legitimate but compromised email accounts to send stolen data to external mail accounts controlled by the attackers," Trend Micro researchers Mohamed Fahmy, Sherif Magdy, and Mahmoud Zohdy said.
While the technique in itself is not unheard of, the development marks the first time OilRig has adopted it in its playbook, indicating the continued evolution of its methods to bypass security protections.
Click to expand...

The advanced persistent threat (APT) group, also referred to as APT34, Cobalt Gypsy, Europium, and Helix Kitten, has been documented for its targeted phishing attacks in the Middle East since at least 2014.

The most notable aspect of the .NET backdoor is its exfiltration routine, which involves using the stolen credentials to send electronic missives to actor-controlled email Gmail and Proton Mail addresses.

"The threat actors relay these emails via government Exchange Servers using vaild accounts with stolen passwords," the researchers said.
Click to expand...

If anything, the growing number of malicious tools associated with OilRig indicates the threat actor's "flexibility" to come up with new malware based on the targeted environments and the privileges possessed at a given stage of the attack.

"Despite the routine's simplicity, the novelty of the second and last stages also indicate that this entire routine can just be a small part of a bigger campaign targeting governments," the researchers said.
Click to expand...

Trend Micro: New APT34 Malware Targets The Middle East

By: Mohamed Fahmy, Sherif Magdy, Mahmoud Zohdy - February 2, 2023
On December 2022, we identified a suspicious executable (detected by Trend Micro as Trojan.MSIL.REDCAP.AD) that was dropped and executed on multiple machines. Our investigation led us to link this attack to advanced persistent threat (APT) group APT34, and the main goal is to steal users’ credentials.

While not new as a technique, this is the first instance that APT34 used this for their campaign deployment. Following this analysis, it is highly likely that this campaign’s routine is only a small part of a bigger chain of deployments.
Click to expand...

Log in or Sign up

OilRig APT Drills into Malware Innovation with Unique Backdoor

guest Guest

guest Guest

Log in or Sign up

OilRig APT Drills into Malware Innovation with Unique Backdoor

guest Guest

guest Guest

Useful Searches