Wednesday, June 19, 2024

Adwind RAT Malware Attacks on US Petroleum Industry to Steal Sensitive Data

A new malware campaign with the Adwind RAT variant particularly targets the petroleum industry in the US. Adwind, a.k.a Unrecom, Sockrat, JSocket, and jRat is a cross-platform RAT involved in multiple campaigns and it was also distributed via malware-as-a-service in underground markets.

With this campaign threat, actors used a new variant of adware RAT that implements multi-layer obfuscation to try to evade detection.

“We found multiple RAT samples hosted on the serving domain and spread across multiple directories, all hosted within the last month,” reads Netskope report.

Adwind RAT Infection

The RAT served as a JAR payload from the domain “members[.]westnet[.]com[.]au/~joeven/”, Westnet is an Australian based ISP. Researchers noted that the same RAT hosted in multiple accounts and to evade detection they the extensions (*.png.jar.jar).

Once the JAR gets dropped in target machine, it creates a copy of itself into the %User% directory and creates registry entry to maintain persistence. Later it executes scripts to disable antivirus and firewall.

Then it creates an AES encryption routine and executes as a new Java thread and it loads the JRAT(Java Runtime Analysis Toolkit) class. JRAT is the open-source performance profiler for the Java platform.

The loaded JRAT class is responsible for downloading the RAT by connecting to the command and control server at 185[.]205[.]210[.]48. The RAT was cross-platform supported, it supports Windows, Linux, and Mac machines.

RAT Functionalities

  • Takes screenshots
  • Harvests credentials from Chrome, IE, and Edge
  • Accesses the webcam, record video and take photos
  • Records audio from the microphone
  • Encrypt and Transfers files
  • Collects general system and user information
  • Steals VPN certificates
  • Serves as a Key Logger

When compared to the previous campaigns the functionality of the RAT remains the same, threat actors made changes in the injection process to evade detection.

Indicators Of Compromise


You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates


Latest articles

Amtrak Data Breach: Hackers Accessed User’s Email Address

Amtrak notified its customers regarding a significant security breach involving its Amtrak Guest Rewards...

Chrome Security Update – Patch for 6 Vulnerabilities

Google has announced a new update for the Chrome browser, rolling out version 126.0.6478.114/115...

Hackers Weaponize Windows Installer (MSI) Files to Deliver Malware

Cybersecurity researchers have uncovered a sophisticated malware campaign orchestrated by a threat actor group,...

Hackers Using VPNs To Exploit Restrictions & Steal Mobile Data

Hackers are offering "free" mobile data access on Telegram channels by exploiting loopholes in...

New PhaaS Platform Lets Attackers Bypass Two-Factor Authentication

Several phishing campaign kits have been used widely by threat actors in the past....

Stuxnet, The Malware That Propagates To Air-Gapped Networks

Stuxnet, a complex worm discovered in 2010, targeted Supervisory Control and Data Acquisition (SCADA)...

Threat Actors Claiming Breach of AMD Source Code on Hacking Forums

A threat actor named " IntelBroker " claims to have breached AMD in June...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles