Thursday, April 18, 2024

Hackers Attack Financial Institutions & Government Organizations With “Proyecto RAT”

Security researchers observed a new campaign targeting financial institutions and governmental organizations with a customized version of a remote access tool called “Proyecto RAT”.

The payload found to be written in Visual Basic 6 and it uses Disposable E-mail Address service yopmail for its C&C communication. The yopmail is known for creating temporary inboxes.

Infection Process

According to the Trend Micro report, the attack primarily targets the organizations in the South American region, particularly in Colombia. The infection starts with a customized email sent to the target from open or compromised mail servers in the South America region.

The Email contains an RTF attachment file and contains tempting subjects

  • “Hemos iniciado un proceso en su contra por violencia laboral.” (Loosely translates to “We have filed a lawsuit against you for workplace violence.”)
  • “Se hara efectivo un embargo a su(s) cuenta(s) Bancarias.” (Loosely translates to “Your banking accounts are going to be blocked.”)
  • “Almacenes exito te obsequia una tarjeta regalo virtual por valor de $500.000.” (Loosely translates to “Exito shops offer you a virtual gift worth $500.000.”)

The attachment contains shorten links that direct victims to file-sharing services, the delivery file is a macro-enabled MHTML file. The macrocode is responsible for downloading and executing the first stage payload Imminent Monitor RAT.

As the name indicates it monitors all the network activities and includes information for executing the second-stage payload. The Imminent Monitor RAT supports a wide range of monitoring activities that include spying on keyboards, File transfer, Grabbing screenshots and recording audio feeds.

Second Stage Payload – Proyecto RAT

The second stage of the payload is the “Proyecto RAT” which uses a disposable yopmail email service for C&C communication.

Based on the Trend Micro analysis report, “the malware connects to a mailbox, reads the only available email message, parses it, and then extracts the subject of the email. The C&C server URL is between the ‘¡’ characters, a character used in the Spanish language and tree email boxes has been used.”

Researchers believe that “Proyecto RAT” “is an old and limited version of the Xpert RAT — either a custom modification of Xpert RAT or malware with source code based on Xpert RAT’s.”

The attacks target South American and Colombia is the most targeted country, followed to the campaign, the recent campaigns appeared to be targeting government entities, healthcare/pharmaceutical institutions, agro-industry/food/packaging organizations.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Related Read

TA505 APT Hackers using New AndroMut Malware to Drop FlawedAmmyy RAT and Gain Remote Access

OceanLotus APT Group Uses Undetected Ratsnif Remote Trojan to Leverage Network Attack’s


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles