Saturday, May 25, 2024

Andariel Hackers Attacking Asset Management Companies to Inject Malicious Code

The Andariel threat group was observed conducting persistent attacks against domestic businesses, specifically installing MeshAgent for remote screen control while conducting the attack.

MeshAgent collects basic system information for remote management and performs activities such as power and account management, chat or message pop-ups, file upload/download, and command execution

It also has remote desktop support. In particular, the web supports remote desktop protocols like RDP and VNC.

“The attacker exploited domestic asset management solutions to install malicious code, most notably AndarLoader and ModeLoader”, AhnLab Security Intelligence Center (ASEC) shared with Cyber Security News.

Among the threat groups currently targeting Korea are the Andariel group, the Kimsuky group, and the Lazarus group. 

As part of the initial access, it has also been known to launch supply chain, spear phishing, or watering hole attacks.

The malware is spread by taking advantage of installed software or flaws in the attack process.

Several Malware Backdoors Employed 

AndarLoader is similar to Andardoor, discovered in an attack case that misused the Innorix Agent.

However, in contrast to Andardoor, the majority of the backdoor functions used by AndarLoader carry out the attacker’s commands via binary, executable data obtained from the C&C server, such as the .NET assembly.

“The AndarLoader confirmed this time is characterized by being obfuscated using KoiVM, unlike past types that were obfuscated with the Dotfuscator tool,” researchers said.

The attacker erased the compromised system’s security event log using AndarLoader and the command “wevtutil cl security.”

AndarLoader obfuscated with KoiVM
AndarLoader obfuscated with KoiVM

Additionally, MeshAgent gathers the fundamental system information needed for remote management.

The use of MeshAgent by the Andariel group was first verified, and it was downloaded externally under the name “fav.ico.”

MeshAgent installation log
MeshAgent installation log

ModeLoader is a JavaScript malware that the Andariel group has been using nonstop in the past.

It is downloaded and run externally via Mshta rather than being created as a file. 

“Attackers mainly exploit asset management solutions to execute the Mshta command that downloads ModeLoader”, researchers said.

ModeLoader executing commands received from the C&C server
ModeLoader executing commands received from the C&C server

Researchers say the attack campaign verified a feature:

in the majority of attack cases, keylogger malware was also detected.

The malware records data copied to the clipboard and keylogger and offers keylogging functionality.

Since its previous use of Innorix Agent, the Andariel group has been consistently abusing the asset management solutions of domestic businesses to disseminate malware during lateral movement.


Users must exercise extra caution when opening executable files from websites or attachments to emails from unknown senders.

Corporate security employees ought to strengthen asset management solution monitoring and apply fixes when there are program security flaws.

Also, take precautions to avoid being infected by this kind of malware beforehand by updating the most recent patches and V3 for operating systems and web browsers.

With Perimeter81 malware protection, you can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits. All are incredibly harmful and can wreak havoc on your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles