Tuesday, March 5, 2024

APT Hackers Attack Indian Financial Institutions To Exfiltrate the Sensitive Data With Crimson RAT

Researchers uncovered a new wave of an APT campaign that target the Indian financial institutions with the powerful Crimson RAT to compromise the network devices and exfiltrate the sensitive data.

Crimson RAT was initially observed in 2016 that targeted the Indian diplomatic and military resources on behalf of APT attack, since then threat actors are continuously targeting the financial, healthcare, and space technology sectors.

The recently observed campaign has specifically targeted the Indian Financial institutions with spear-phishing emails.

Crimson RAT Infection Process

 A Phishing email campaign contains a malicious attachment and the email send to a targeted organization in two different ways.

A first method malformed Email campaign hit the target with a malicious link that pointed to PE (executable) file that contains two ZIP files with an embedded document.

Once the payload executed by the victim, it automatically checks the OS version of the system and report to the C2 server and drop the ZIP payload based on 32-bit or 64-bit version.

According to zscaler report “The ZIP payload is dropped at C:\ProgramData\Bhoithas\dhdxcia.zip, after which the ZIP file is extracted in the same directory with the name brwmarivas.exe, and then it’s executed, which results in the Crimson RAT.”

Another spear-phishing campaign contains a malformed DOC file that has embedded with malicious macro, once victims enable the macro it executes the RAT payload and loads the clean Resume/CV file.

“Similar to Campaign 1, two PE files are stored in the value of Textboxes of UserForm1. Based on the OS version of the victim’s system, it drops a Crimson RAT payload at C:\ProgramData\Hblondas\rihndimrva.exe and executes it.”

Crimson RAT has running following command to perform the respective operation.

Commands    Descriptions  
getavsList of running processes
thumbGet 200×150 thumbnail of image
filszGet the file meta info
rupthGet the malware’s run path
dowfGet file from C&C and save on disk
endpoKill a process by PID
scrszGet the screen size
cscreenGet single screenshot
dirsList the drive info
stopsStop screen capturing
screnCapture screen continuously
cnlsStop upload, download & screen capture
udltDownload a payload from C&C, save & execute it
deltDelete provided file
afileUpload file with meta info to C&C
listfSearch for given extension files
fileUpload a file to C&C
infoSend machine info
runfExecute a command
flesList files in a directory
dowrGet file from C&C and execute
fldrList folders in a directory

Crimson RAT has a function to exfiltrate the sensitive data from the compromised victim  and transfer the collected data over non-web channels to its command-and-control (C&C) server. 

The RAT keeps receiving the commands from the C&C server, performs the desired activities and keeps update the result to the C2 server that controlled by the attacker.

You can share your thoughts about the article via  Twitter,  Facebook and Linkedin page also get the Daily cyber security & hacking news updates.


Latest articles

CACTUS Hackers Exploiting Software Bug to Attack Corporate Networks

Threat actors known as CACTUS orchestrated a sophisticated attack on two companies simultaneously, exploiting...

GTPDOOR – Previously Unknown Linux Malware Attack Telecom Networks

Researchers have discovered a new backdoor named GTPDOOR that targets telecommunication network systems within...

US Court Orders NSO Group to Handover Code for Spyware, Pegasus to WhatsApp

Meta, the company that owns WhatsApp, filed a lawsuit against NSO Group in 2019....

New SSO-Based Phishing Attack Trick Users into Sharing Login Credentials  

Threat actors employ phishing scams to trick individuals into giving away important details like...

U.S. Charged Iranian Hacker, Rewards up to $10 Million

The United States Department of Justice (DoJ) has charged an Iranian national, Alireza Shafie...

Huge Surge in Ransomware-as-a-Service Attacks targeting Middle East & Africa

The Middle East and Africa (MEA) region has witnessed a surge in ransomware-as-a-service (RaaS)...

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles