Thursday, December 7, 2023

OceanLotus APT Group Uses Undetected Ratsnif Remote Trojan to Leverage Network Attack’s

OceanLotus APT Group also known as APT32, SeaLotus, and CobaltKitty uses undetected Remote Access trojans Ratsnif to leverage network attack capabilities. The trojan was active since 2016, and it has features like packet sniffing, gateway/device ARP poisoning, DNS poisoning, HTTP injection, and MAC spoofing.

The Cylance Threat Research Team detected four distinct samples of Ratsnif trojan, out of four, three of them found developed in 2016 and one sample in 2018. There is no significant change with the version developed in 2016, and they are similar in functionality.

The fourth sample was developed in the second half of 2018; it has significant changes when compared to the previous version. Previous samples entirely depend on C2 servers, whereas the current sample doesn’t rely on C2 servers for operations.

It also includes some new features such as HTTP injection, protocol parsing, and SSL hijacking. It uses WolfSSL library for traffic decryption and http_parser.c for parsing HTTP traffic.The new sample also includes features like protocol parsing, ARP poisoning, DNS spoofing, HTTP redirection, and HTTP injection.

Ratsnif Multi-stage Infection

The initial payload is the loader DLL that copies 1st stage shellcode into memory and execute it. Which decompress the 2nd stage payload is the shellcode that executes into the memory and hooks several API functions that responsible for returning command line.

Researchers identified a bug in Ratsnif that could lead to memory read violation when parsing a specific parameter (“dwn_ip’). What happens is that the value is passed as a string and it should be passed as a pointer to a string.

The 2018 variant employs multiple sniffers for harvesting sensitive information from packets and to minimize the data extraction and to exfiltrate the process.

Ratsnif contains Base64 encoded C2 URL, but the trojan didn’t use it. Instead, it logs the captured information in a text, and uses another module to exfiltrate it, reads the analysis.

“Ratsnif is an intriguing discovery considering the length of time it has remained undetected, likely due to limited deployment. It offers a rare glimpse of over two years of feature development, allowing us to observe how threat actors tailor tooling to their nefarious purposes.”

In the previous campaign, OceanLotus uses steganography method to hide the encrypted malware payload within a .png image file to infect the targeted system.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...

Hackers Deliver AsyncRAT Through Weaponized WSF Script Files

The AsyncRAT malware, which was previously distributed through files with the .chm extension, is now being...

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles