Monday, July 22, 2024

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef. This operation leverages the SugarGh0st RAT and other malware to target government agencies, research institutions, and various organizations worldwide.

The campaign began in early August 2023 and initially targeted users in Uzbekistan and South Korea. However, it has since expanded to include targets in a wider geographical area, including:

  • EMEA: Angola, Turkmenistan, Kazakhstan, India, Saudi Arabia, and Latvia
  • Asia: India, Uzbekistan, and Kazakhstan
  • Europe: Latvia and Lithuania

The attackers use decoy documents to impersonate government agencies and research institutions and lure victims. These documents include:

  • Government-themed lures: Circulars, reports, and announcements from various ministries and embassies
  • Research conference-themed lures: Abstracts, application forms, and invitations to conferences

Malware and Infection Chain

Two infection chains utilized a malicious RAR with an LNK file, likely delivered via phishing email.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

According tot the Talos report, The campaign employs the SugarGh0st RAT and another RAT dubbed “SpiceRAT.” The infection chain uses SFX RAR files as the initial attack vector.

When executed, these files drop a decoy document, a DLL loader, encrypted SugarGh0st, and a malicious VB script into the victim’s temporary user profile folder.

The VB script establishes persistence by writing a command to the registry key UserInitMprLogonScript, which executes when a user logs into the system.

The loader DLL reads the encrypted SugarGh0st RAT, decrypts it, and injects it into a process. This technique is similar to that used in a previous SugarGh0st campaign disclosed by the Kazakhstan government in February.

Despite initial disclosure in November 2023, the SneakyChef threat actor continues to leverage old and new command and control (C2) domains.

The C2 domain account[.]drive-google-com[.]tk was still active until mid-May, and a new domain, account[.]gommask[.]online, was created in March 2024.

Indicators of Compromise associated with this threat can be found here.

Mitigation and Response

The discovery of this campaign highlights the importance of robust cybersecurity measures. Organizations should:

  1. Update security software to include the latest threat definitions.
  2. Educate employees about phishing attacks and safe email practices.
  3. Implement advanced network monitoring to detect unusual activities.
  4. Maintain regular backups of critical data to mitigate the impact of potential breaches.

The ongoing activities of the SneakyChef threat actor underscore the need for continuous vigilance in the digital age.

Free Webinar! 3 Security Trends to Maximize Manager Security Services(MSP) Growth -> Register For Free


Latest articles

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities. Such...

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the...

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects...

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024,...

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support...

UK Police Arrested 17-year-old Boy Responsible for MGM Resorts Hack

UK police have arrested a 17-year-old boy from Walsall in connection with a notorious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles