Friday, May 9, 2025
HomeUncategorizedNew RAT Malware SneakyChef & SugarGhost Attack Windows Systems

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Published on

SIEM as a Service

Follow Us on Google News

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef. This operation leverages the SugarGh0st RAT and other malware to target government agencies, research institutions, and various organizations worldwide.

The campaign began in early August 2023 and initially targeted users in Uzbekistan and South Korea. However, it has since expanded to include targets in a wider geographical area, including:

  • EMEA: Angola, Turkmenistan, Kazakhstan, India, Saudi Arabia, and Latvia
  • Asia: India, Uzbekistan, and Kazakhstan
  • Europe: Latvia and Lithuania

The attackers use decoy documents to impersonate government agencies and research institutions and lure victims. These documents include:

- Advertisement - Google News
  • Government-themed lures: Circulars, reports, and announcements from various ministries and embassies
  • Research conference-themed lures: Abstracts, application forms, and invitations to conferences

Malware and Infection Chain

Two infection chains utilized a malicious RAR with an LNK file, likely delivered via phishing email.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

According tot the Talos report, The campaign employs the SugarGh0st RAT and another RAT dubbed “SpiceRAT.” The infection chain uses SFX RAR files as the initial attack vector.

When executed, these files drop a decoy document, a DLL loader, encrypted SugarGh0st, and a malicious VB script into the victim’s temporary user profile folder.

The VB script establishes persistence by writing a command to the registry key UserInitMprLogonScript, which executes when a user logs into the system.

The loader DLL reads the encrypted SugarGh0st RAT, decrypts it, and injects it into a process. This technique is similar to that used in a previous SugarGh0st campaign disclosed by the Kazakhstan government in February.

Despite initial disclosure in November 2023, the SneakyChef threat actor continues to leverage old and new command and control (C2) domains.

The C2 domain account[.]drive-google-com[.]tk was still active until mid-May, and a new domain, account[.]gommask[.]online, was created in March 2024.

Indicators of Compromise associated with this threat can be found here.

Mitigation and Response

The discovery of this campaign highlights the importance of robust cybersecurity measures. Organizations should:

  1. Update security software to include the latest threat definitions.
  2. Educate employees about phishing attacks and safe email practices.
  3. Implement advanced network monitoring to detect unusual activities.
  4. Maintain regular backups of critical data to mitigate the impact of potential breaches.

The ongoing activities of the SneakyChef threat actor underscore the need for continuous vigilance in the digital age.

Free Webinar! 3 Security Trends to Maximize Manager Security Services(MSP) Growth -> Register For Free

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

New Advanced Phishing Attack Exploits Discord to Target Crypto Users

Check Point Research has uncovered a sophisticated phishing campaign that leverages Discord to target...

Fedora Linux Joins the Windows Subsystem for Linux Officially

Fedora Project has announced the official availability of Fedora Linux on the Windows Subsystem...

Microsoft Launches “Copilot+ PC” for an Upgraded Windows Experience

Microsoft has announced a significant wave of new Windows experiences designed for Copilot+ PCs,...

Nomad Bridge Hacker Apprehended in Connection with $190 Million Heist

Alexander Gurevich, a 47-year-old dual Russian-Israeli citizen, was arrested last Thursday at Ben-Gurion Airport...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

PostgreSQL Vulnerability Allows Hackers To Execute Arbitrary SQL Functions

A critical vulnerability identified as CVE-2024-7348 has been discovered in PostgreSQL, enabling attackers to...

Security Risk Advisors Announces Launch of VECTR Enterprise Edition

Security Risk Advisors (SRA) announces the launch of VECTR Enterprise Edition, a premium version...

4 Leading Methods of Increasing Business Efficiency 

The more efficient your core business operations, the more motivated and productive your employees...