New AtlasCross APT Using Weaponized Word Documents to Deploy Malware

Cybersecurity analysts at NSFOCUS Security Labs recently uncovered an unknown phishing-based attack process during threat-hunting. 

Apart from this, during their further investigation, they identified two new Trojans and rare attack methods.

NSFOCUS Security Labs suspects a skilled APT attacker is behind the novel phishing process, using it as a primary method for in-domain penetration against specific targets.

AtlasCross is the attacker, while DangerAds and AtlasAgent are the new Trojans identified by NSFOCUS Security Labs.

Security researchers reported that threat actors behind AtlasCross are actively using the weaponized Word documents to deploy malware.

FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Free Demo

Technical analysis

AtlasCross used a bait document, ‘Blood Drive September 2023.docm,’ posing as a US Red Cross blood donation file. Upon opening, it prompts victims to enable word editing.

Enabling macros reveals hidden US Red Cross blood donation content in the decoy document. Considering the attacker’s design in the next attack stage, it suggests a targeted cyberattack on Red Cross affiliates.

This attack unfolds in three phases: decoy document, loader, and Trojan horse. The malicious macro in the decoy doc carries out key tasks, including payload release, scheduling, and uploading victim host info. It extracts and saves files like:-

• KB4495667.zip
• KB4495667.pkg

The malicious program ‘KB4495667.pkg,’ dubbed ‘DangerAds’ by NSFOCUS Security Labs, serves as the loader Trojan in the second attack phase. 

It checks the host environment and runs a built-in shellcode to load the third-stage payload. Notably, it activates only if specific user or domain strings are detected, hinting at intra-domain penetration intentions.

The loader Trojan loads an x86 or x64 DLL program into memory as the final payload, named ‘AtlasAgent’ by NSFOCUS Security Labs. AtlasAgent’s core functions include:-

• Gathering host data
• Running shellcode
• Downloading
• Executing

AtlasCross employed diverse attack tactics, with a focus on defense evasion, resource development, persistence, and more, demonstrating their keen defense awareness.

Here below, we have mentioned all the CMD instructions that are supported by AtlasAgent Trojan, along with their respective functions:-

• 0x0: Obtain computer system information
• 0x1: Reverse Shell
• 0x2: Obtain data from CnC and store it in the specified file
• 0x3: It is guessed to be the field for debugging
• 0x4: Pause the program for a period of time using the Sleep function
• 0x5: Obtain process information
• 0x6: Inject shellcode into a new thread of the specified process
• 0x7: This parameter function is to be implemented.
• 0x8: Run shellcode directly or create a thread to run shellcode in this process
• 0x9: No function, Break out of circulation
• 0xB: Injects shellcode or command into a thread in the specified process
• 0xC: Create a mutex
• 0x63: Exit cycle

AtlasCross demonstrates great process and tool development abilities by incorporating and modifying:-

• Multiple hacker technologies
• Prioritizing security above efficiency
• Improving their strategies regularly

These characteristics underline their ongoing high-level threat, possibly identifying major targets for upcoming intrusions.

IOCs

IOCs (Source –  NSFocus)

Protect yourself from vulnerabilities using Patch Manager Plus to quickly patch over 850 third-party applications. Take advantage of the free trial to ensure 100% security.