Tuesday, July 16, 2024

Earth Preta Hackers Abuses Google Drive to Deploy DOPLUGS Malware

Threat actors abuse Google Drive for several malicious activities due to its widespread use, easy file sharing, and collaboration features.

These things provide a convenient platform to host and distribute malware. Integration with legitimate services makes detecting and blocking malicious content challenging.

Cybersecurity researchers at Check Point recently found SMUGX in July 2023, linked to Earth Preta, hitting Europe. They also found a phishing email with PlugX in Taiwan tied to SMUGX.

Researchers found a new variant, DOPLUGS, which differs from typical PlugX and is mainly used for downloading. 

It employs the KillSomeOne module and was first reported by Sophos in 2020. Earth Preta campaign researchers analyze DOPLUGS, noting its backdoor commands, integration with KillSomeOne, and changes over time.

Live Account Takeover Attack Simulation

How do Hackers Bypass 2FA?

Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks.

Technical analysis

DOPLUGS files found since July 2023 indicate victims from Taiwan and Mongolia. File names suggest social engineering tied to recent events, like the January 2024 Taiwanese presidential election.

The “水源路二至五期整建住宅都市更新推動說明.pdf” decoy file relates to a Taiwanese urban renewal project in traditional Chinese.

The decoy document (Source - Trend Micro)
The decoy document (Source – Trend Micro)

The Үер усны сэрэмжлүүлэг.pdf decoy warns of floods in Mongolia, in Mongolian. From 2022-2023 VirusTotal data (Asia-focused), Taiwan and Vietnam were prime targets, with fewer attacks in China, Singapore, Hong Kong, Japan, India, Malaysia, and Mongolia.

The decoy document 'Үер усны сэрэмжлүүлэг.pdf' (Source - Trend Micro)
The decoy document ‘Үер усны сэрэмжлүүлэг.pdf’ (Source – Trend Micro)

The spear-phishing emails carry a Google Drive link, which leads to a password-protected archive with DOPLUGS malware. 

Disguised as documents, LNK files in the RAR archive download MSI files from https://getfiledown[.]com/vgbskgyu, which helps trigger subsequent file drops.

  • %localappdata%\MPTfGRunFbCn\OneNotem.exe (legitimate executable)
  • %localappdata%\MPTfGRunFbCn\msi.dll (malicious DLL file)
  • %localappdata%\MPTfGRunFbCn\NoteLogger.dat (encrypted payload)
Timeline of the malware evolution (Source - Trend Micro)
Timeline of the malware evolution (Source – Trend Micro)

DOPLUGS includes four backdoor commands, as it is a downloader. Among them, one downloads the PlugX malware.

Infection flow of DOPLUGS (Source - Trend Micro)
Infection flow of DOPLUGS (Source – Trend Micro)

Researchers discovered a new DOPLUGS variant with a KillSomeOne module for malware distribution, information collection, and USB-based document theft.

Unlike the previous version, it employs diverse infection methods. There are similarities with the prior DOPLUGS variant, but it has a distinctive infection approach.

Besides this, it has four components, including a malicious DLL and encrypted payload.

Earth Preta targets global government entities, especially in Asia-Pacific and Europe, using spear-phishing emails and Google Drive links. 

DOPLUGS malware is a vital tool for downloading PlugX. Besides this, a 2018 DOPLUGS variant was also discovered with KillSomeOne module integration, indicating ongoing tool improvement.

Since the Earth Preta remains active, the security teams should stay vigilant about Earth Preta’s tactics.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


Latest articles

MirrorFace Attacking Organizations Exploiting Vulnerabilities In Internet-Facing Assets

MirrorFace threat actors have been targeting media, political organizations, and academic institutions since 2022,...

HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware...

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles