Authorities and telecommunications sectors in Southeast Asia have develop into the goal of a “subtle” marketing campaign undertaken by a brand new superior persistent menace (APT) group referred to as Earth Kurma since June 2024.
The assaults, per Pattern Micro, have leveraged customized malware, rootkits, and cloud storage companies for information exfiltration. The Philippines, Vietnam, Thailand, and Malaysia are among the many distinguished targets.
“This marketing campaign poses a excessive enterprise danger as a consequence of focused espionage, credential theft, persistent foothold established by way of kernel-level rootkits, and information exfiltration by way of trusted cloud platforms,” safety researchers Nick Dai and Sunny Lu stated in an evaluation revealed final week.
The menace actor’s actions date again to November 2020, with the intrusions primarily counting on companies like Dropbox and Microsoft OneDrive to siphon delicate information utilizing instruments like TESDAT and SIMPOBOXSPY.
Two different noteworthy malware households in its arsenal embody rootkits equivalent to KRNRAT and Moriya, the latter of which has been noticed beforehand in assaults aimed toward high-profile organizations in Asia and Africa as a part of an espionage marketing campaign dubbed TunnelSnake.
Pattern Micro additionally stated that SIMPOBOXSPY and the exfiltration script used within the assaults share overlaps with one other APT group codenamed ToddyCat. Nevertheless, a definitive attribution stays inconclusive.
It is at present not referred to as to how the menace actors acquire preliminary entry to focus on environments. The preliminary foothold is then abused to scan and conduct lateral motion utilizing quite a lot of instruments like NBTSCAN, Ladon, FRPC, WMIHACKER, and ICMPinger. Additionally deployed is a keylogger known as KMLOG to reap credentials.
It is value noting that using the open-source Ladon framework has been beforehand attributed to a China-linked hacking group referred to as TA428 (aka Vicious Panda).
Persistence on the hosts is achieved by three totally different loader strains known as DUNLOADER, TESDAT, and DMLOADER, that are able to loading next-stage payloads into reminiscence and executing them. These encompass Cobalt Strike Beacons, rootkits like KRNRAT and Moriya, in addition to information exfiltration malware.
What distinguishes these assaults is using living-off-the-land (LotL) strategies to put in the rootkits, the place hackers make use of official system instruments and options, on this case, syssetup.dll, slightly than introducing simply detectable malware.
Whereas Moriya is engineered to examine incoming TCP packets for a malicious payload and inject shellcode right into a newly spawned “svchost.exe” course of, KRNRAT is an amalgamation of 5 totally different open-source initiatives with capabilities equivalent to course of manipulation, file hiding, shellcode execution, visitors concealment, and command-and-control (C2) communication.
KRNRAT, like Moriya, can be designed to load a user-mode agent the rootkit and inject it into “svchost.exe.” The user-mode agent serves as a backdoor to retrieve a follow-on payload from the C2 server.
“Earlier than exfiltrating the recordsdata, a number of instructions executed by the loader TESDAT collected particular doc recordsdata with the next extensions: .pdf, .doc, .docx, .xls, .xlsx, .ppt, and .pptx,” the researchers stated. “The paperwork are first positioned right into a newly created folder named “tmp,” which is then archived utilizing WinRAR with a selected password.”
One of many bespoke instruments used for information exfiltration is SIMPOBOXSPY, which may add the RAR archive to Dropbox with a selected entry token. In keeping with a Kasperksy report from October 2023, the generic DropBox uploader is “in all probability not solely utilized by ToddyCat.”
ODRIZ, one other program used for a similar objective, uploads the collected data to OneDrive by specifying the OneDrive refresh token as an enter parameter.
“Earth Kurma stays extremely lively, persevering with to focus on international locations round Southeast Asia,” Pattern Micro stated. “They’ve the aptitude to adapt to sufferer environments and keep a stealthy presence.”
“They’ll additionally reuse the identical code base from beforehand recognized campaigns to customise their toolsets, typically even using the sufferer’s infrastructure to attain their targets.”
