Authorities and telecommunications sectors in Southeast Asia have change into the goal of a “subtle” marketing campaign undertaken by a brand new superior persistent menace (APT) group referred to as Earth Kurma since June 2024.
The assaults, per Pattern Micro, have leveraged customized malware, rootkits, and cloud storage providers for knowledge exfiltration. The Philippines, Vietnam, Thailand, and Malaysia are among the many distinguished targets.
“This marketing campaign poses a excessive enterprise danger attributable to focused espionage, credential theft, persistent foothold established by means of kernel-level rootkits, and knowledge exfiltration through trusted cloud platforms,” safety researchers Nick Dai and Sunny Lu said in an evaluation printed final week.
The menace actor’s actions date again to November 2020, with the intrusions primarily counting on providers like Dropbox and Microsoft OneDrive to siphon delicate knowledge utilizing instruments like TESDAT and SIMPOBOXSPY.
Two different noteworthy malware households in its arsenal embrace rootkits equivalent to KRNRAT and Moriya, the latter of which has been noticed beforehand in assaults geared toward high-profile organizations in Asia and Africa as a part of an espionage marketing campaign dubbed TunnelSnake.
Pattern Micro additionally stated that SIMPOBOXSPY and the exfiltration script used within the assaults share overlaps with one other APT group codenamed ToddyCat. Nonetheless, a definitive attribution stays inconclusive.
It is at the moment not often called to how the menace actors acquire preliminary entry to focus on environments. The preliminary foothold is then abused to scan and conduct lateral motion utilizing a wide range of instruments like NBTSCAN, Ladon, FRPC, WMIHACKER, and ICMPinger. Additionally deployed is a keylogger known as KMLOG to reap credentials.
It is price noting that the usage of the open-source Ladon framework has been beforehand attributed to a China-linked hacking group referred to as TA428 (aka Vicious Panda).
Persistence on the hosts is achieved by three completely different loader strains known as DUNLOADER, TESDAT, and DMLOADER, that are able to loading next-stage payloads into reminiscence and executing them. These include Cobalt Strike Beacons, rootkits like KRNRAT and Moriya, in addition to knowledge exfiltration malware.
What distinguishes these assaults is the usage of living-off-the-land (LotL) methods to put in the rootkits, the place hackers make use of reliable system instruments and options, on this case, syssetup.dll, somewhat than introducing simply detectable malware.
Whereas Moriya is engineered to examine incoming TCP packets for a malicious payload and inject shellcode right into a newly spawned “svchost.exe” course of, KRNRAT is an amalgamation of 5 completely different open-source initiatives with capabilities equivalent to course of manipulation, file hiding, shellcode execution, visitors concealment, and command-and-control (C2) communication.
KRNRAT, like Moriya, can also be designed to load a user-mode agent the rootkit and inject it into “svchost.exe.” The user-mode agent serves as a backdoor to retrieve a follow-on payload from the C2 server.
“Earlier than exfiltrating the information, a number of instructions executed by the loader TESDAT collected particular doc information with the next extensions: .pdf, .doc, .docx, .xls, .xlsx, .ppt, and .pptx,” the researchers stated. “The paperwork are first positioned right into a newly created folder named “tmp,” which is then archived utilizing WinRAR with a particular password.”
One of many bespoke instruments used for knowledge exfiltration is SIMPOBOXSPY, which might add the RAR archive to Dropbox with a particular entry token. Based on a Kasperksy report from October 2023, the generic DropBox uploader is “most likely not completely utilized by ToddyCat.”
ODRIZ, one other program used for a similar objective, uploads the collected data to OneDrive by specifying the OneDrive refresh token as an enter parameter.
“Earth Kurma stays extremely lively, persevering with to focus on nations round Southeast Asia,” Pattern Micro stated. “They’ve the potential to adapt to sufferer environments and keep a stealthy presence.”
“They will additionally reuse the identical code base from beforehand recognized campaigns to customise their toolsets, typically even using the sufferer’s infrastructure to attain their targets.”
Source link