Hackers Attack Financial Institutions & Government Organizations With “Proyecto RAT”

Security researchers observed a new campaign targeting financial institutions and governmental organizations with a customized version of a remote access tool called “Proyecto RAT”.

The payload found to be written in Visual Basic 6 and it uses Disposable E-mail Address service yopmail for its C&C communication. The yopmail is known for creating temporary inboxes.

Infection Process

According to the Trend Micro report, the attack primarily targets the organizations in the South American region, particularly in Colombia. The infection starts with a customized email sent to the target from open or compromised mail servers in the South America region.

The Email contains an RTF attachment file and contains tempting subjects

  • “Hemos iniciado un proceso en su contra por violencia laboral.” (Loosely translates to “We have filed a lawsuit against you for workplace violence.”)
  • “Se hara efectivo un embargo a su(s) cuenta(s) Bancarias.” (Loosely translates to “Your banking accounts are going to be blocked.”)
  • “Almacenes exito te obsequia una tarjeta regalo virtual por valor de $500.000.” (Loosely translates to “Exito shops offer you a virtual gift worth $500.000.”)

The attachment contains shorten links that direct victims to file-sharing services, the delivery file is a macro-enabled MHTML file. The macrocode is responsible for downloading and executing the first stage payload Imminent Monitor RAT.

As the name indicates it monitors all the network activities and includes information for executing the second-stage payload. The Imminent Monitor RAT supports a wide range of monitoring activities that include spying on keyboards, File transfer, Grabbing screenshots and recording audio feeds.

Second Stage Payload – Proyecto RAT

The second stage of the payload is the “Proyecto RAT” which uses a disposable yopmail email service for C&C communication.

Based on the Trend Micro analysis report, “the malware connects to a mailbox, reads the only available email message, parses it, and then extracts the subject of the email. The C&C server URL is between the ‘¡’ characters, a character used in the Spanish language and tree email boxes has been used.”

Researchers believe that “Proyecto RAT” “is an old and limited version of the Xpert RAT — either a custom modification of Xpert RAT or malware with source code based on Xpert RAT’s.”

The attacks target South American and Colombia is the most targeted country, followed to the campaign, the recent campaigns appeared to be targeting government entities, healthcare/pharmaceutical institutions, agro-industry/food/packaging organizations.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Related Read

TA505 APT Hackers using New AndroMut Malware to Drop FlawedAmmyy RAT and Gain Remote Access

OceanLotus APT Group Uses Undetected Ratsnif Remote Trojan to Leverage Network Attack’s

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Lotus Blossom Hacker Group Uses Dropbox, Twitter, and Zimbra for C2 Communications

The Lotus Blossom hacker group, also known as Spring Dragon, Billbug, or Thrip, has been…

3 hours ago

Squidoor: Multi-Vector Malware Exploiting Outlook API, DNS & ICMP Tunneling for C2

A newly identified malware, dubbed "Squidoor," has emerged as a sophisticated threat targeting government, defense,…

3 hours ago

Unpatched Vulnerabilities Attract Cybercriminals as EDR Visibility Remains Limited

Cyber adversaries have evolved into highly organized and professional entities, mirroring the operational efficiency of…

3 hours ago

Threat Actors Attack Job Seekers of Fortune 500 Companies to Steal Personal Details

In Q3 2024, Cofense Intelligence uncovered a targeted spear-phishing campaign aimed at employees working in…

3 hours ago

DragonForce Attacks Critical Infrastructure to Exfiltrate Data and Halt Operations

The DragonForce ransomware group has launched a significant cyberattack on critical infrastructure in Saudi Arabia,…

3 hours ago

New Malware Uses Legitimate Antivirus Driver to Bypass All System Protections

In a concerning development, cybersecurity researchers at Trellix have uncovered a sophisticated malware campaign that…

4 hours ago