Friday, June 14, 2024

APT Hackers Attack Indian Financial Institutions To Exfiltrate the Sensitive Data With Crimson RAT

Researchers uncovered a new wave of an APT campaign that target the Indian financial institutions with the powerful Crimson RAT to compromise the network devices and exfiltrate the sensitive data.

Crimson RAT was initially observed in 2016 that targeted the Indian diplomatic and military resources on behalf of APT attack, since then threat actors are continuously targeting the financial, healthcare, and space technology sectors.

The recently observed campaign has specifically targeted the Indian Financial institutions with spear-phishing emails.

Crimson RAT Infection Process

 A Phishing email campaign contains a malicious attachment and the email send to a targeted organization in two different ways.

A first method malformed Email campaign hit the target with a malicious link that pointed to PE (executable) file that contains two ZIP files with an embedded document.

Once the payload executed by the victim, it automatically checks the OS version of the system and report to the C2 server and drop the ZIP payload based on 32-bit or 64-bit version.

According to zscaler report “The ZIP payload is dropped at C:\ProgramData\Bhoithas\, after which the ZIP file is extracted in the same directory with the name brwmarivas.exe, and then it’s executed, which results in the Crimson RAT.”

Another spear-phishing campaign contains a malformed DOC file that has embedded with malicious macro, once victims enable the macro it executes the RAT payload and loads the clean Resume/CV file.

“Similar to Campaign 1, two PE files are stored in the value of Textboxes of UserForm1. Based on the OS version of the victim’s system, it drops a Crimson RAT payload at C:\ProgramData\Hblondas\rihndimrva.exe and executes it.”

Crimson RAT has running following command to perform the respective operation.

Commands    Descriptions  
getavsList of running processes
thumbGet 200×150 thumbnail of image
filszGet the file meta info
rupthGet the malware’s run path
dowfGet file from C&C and save on disk
endpoKill a process by PID
scrszGet the screen size
cscreenGet single screenshot
dirsList the drive info
stopsStop screen capturing
screnCapture screen continuously
cnlsStop upload, download & screen capture
udltDownload a payload from C&C, save & execute it
deltDelete provided file
afileUpload file with meta info to C&C
listfSearch for given extension files
fileUpload a file to C&C
infoSend machine info
runfExecute a command
flesList files in a directory
dowrGet file from C&C and execute
fldrList folders in a directory

Crimson RAT has a function to exfiltrate the sensitive data from the compromised victim  and transfer the collected data over non-web channels to its command-and-control (C&C) server. 

The RAT keeps receiving the commands from the C&C server, performs the desired activities and keeps update the result to the C2 server that controlled by the attacker.

You can share your thoughts about the article via  Twitter,  Facebook and Linkedin page also get the Daily cyber security & hacking news updates.


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles