Saturday, May 17, 2025
HomeComputer SecurityOceanLotus(APT32) Threat Actor Group Deliver KerrDown Malware Via Word Document and RAR...

OceanLotus(APT32) Threat Actor Group Deliver KerrDown Malware Via Word Document and RAR Archive

Published on

SIEM as a Service

Follow Us on Google News

OceanLotus group known for Multiple attack campaigns around the globe, the threat actor group targets private sectors across multiple industries, foreign governments, activists, and dissidents connected to Vietnam.

Palo Alto Networks’ Unit 42 division researchers observed a new custom malware family dubbed “KerrDown” used by the threat actor group since 2018. This ongoing campaign primarily targets individuals in Vietnam or Vietnamese speaking individuals.

Threat actors deliver the KerrDown downloader malware to targets in two methods

- Advertisement - Google News
  • Malicious Macro Enabled Word Document
  • RAR archive

Malicious Word Document – KerrDown

Once the victim opens the malicious payload file, it asks victims to enable macros to see the contents of the file, the document contains an image file written in Vietnamese language and two base64 blobs inserted in the page.

In order to deceive the victims and to evade detection from automated tools, the attackers have changed the font size to 1.

KerrDown

Based on the victim’s machine architecture(32 bit/64 bit) the embedded KerrDown DLLs will be dropped in the victim machine.

“The DLL retrieves the payload from the URL, decrypts it by using the DES algorithm and execute it in the memory. Therefore, it is observed that only the KerrDown DLL downloader is saved in the system and the payload directly gets executed in the memory.”

At the time of analysis, researchers found that KerrDown was still active and they able to download the copy of the variant.

RAR Archives – KerrDown

With the RAR variant attackers modified the downloader code, added more stages and hiding each stage by compression and encryption. They also change the way in how the malicious code executes.

When victims open the malicious DLL file from the archive it loads the DLL file and the DLL file loads multiple stages to execute the final payload.

  • Once the victim opens the document it runs wwlib[.]dll in the same directory.
  • The DLL decodes the encoded base64 shellcode and executes.
  • Then shell code decrypts the second shellcode.
  • Second shell code decrypts Third shellcode with AES.
  • Third shellcode retrieves the file from the remote location and executes it.
  • Fourth shellcode loads the cobalt strike beacon and embedded that in the memory.
KerrDown

we have seen with the new KerrDown downloader being used in their recent campaigns, the group continues to build and employ new tools and techniques in their overall operations and playbooks,” the complete list of IoCs can be found in paloaltonetworks blog post.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

Mac Malware Steals Cookies & saved Passwords when Users Visiting Crypto Exchange Service Websites

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...

New Ransomware Attack Targets Elon Musk Supporters Using PowerShell to Deploy Payloads

A newly identified ransomware campaign has emerged, seemingly targeting supporters of Elon Musk through...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...