Chinese language-speaking IronHusky hackers are concentrating on Russian and Mongolian authorities organizations utilizing upgraded MysterySnail distant entry trojan (RAT) malware.
Safety researchers at Kaspersky’s International Analysis and Evaluation Workforce (GReAT) noticed the up to date implant whereas investigating current assaults the place the attackers deployed the RAT malware utilizing a malicious MMC script camouflaged as a Phrase doc, which downloaded second-stage payloads and gained persistence on compromised methods.
One of many malicious payloads is an unknown middleman backdoor that helps switch information between the command and management servers and hacked gadgets, run command shells, create new processes, delete information, and extra.
“In our telemetry, these information turned out to go away footprints of the MysterySnail RAT malware, an implant we described again in 2021. In noticed an infection instances, MysterySnail RAT was configured to persist on compromised machines as a service,” Kaspersky mentioned.
“Notably, a short while after we blocked the current intrusions associated to MysterySnail RAT, we noticed the attackers to proceed conducting their assaults, by deploying a repurposed and extra light-weight model of MysterySnail RAT. This model consists of a single part, and that is why we dubbed it MysteryMonoSnail.”
As they discovered, the upgraded RAT malware helps dozens of instructions, permitting attackers to handle companies on the compromised machine, execute shell instructions, spawn and kill processes, and handle information, amongst different issues.
First noticed virtually 4 years in the past
This newest backdoor model is much like the unique MysterySnail RAT, which Kaspersky first detected in late August 2021 in widespread espionage assaults in opposition to IT firms, navy/protection contractors, and diplomatic entities in Russia and Mongolia.
On the time, the IronHusky hacking group was noticed deploying the malware on methods compromised utilizing zero-day exploits concentrating on a Home windows Win32k kernel driver vulnerability (CVE-2021-40449).
The Chinese language APT was first noticed by Kaspersky in 2017 whereas investigating a marketing campaign concentrating on Russian and Mongolian authorities entities with the tip aim of amassing intelligence on Russian-Mongolian navy negotiations.
One yr later, Kaspersky additionally noticed them exploiting a Microsoft Workplace reminiscence corruption vulnerability (CVE-2017-11882) to unfold RATs sometimes utilized by Chinese language hacking teams, together with PoisonIvy and PlugX.
The Kaspersky report revealed on Thursday contains indicators of compromise and extra technical particulars about IronHusky’s current assaults utilizing the MysterySnail RAT.
