42
Upatre Continued to Evolve with new Anti
Unit 42 analyzes an undocumented Upatre downloader variant with VM detection via process hashing, packed code, disabled Windows defenses and Namecoin .bit C2 domains.
Unit 42 analyzed an Upatre downloader variant compiled in December 2016 that went largely undetected by automated systems, featuring heavy code flow obscuration, on-demand decryption of network communications, and novel virtual machine detection. The sample enumerates running processes, computes CRC32 hashes XORed with a hard-coded key, and sleeps if analysis-related processes such as vmtoolsd.exe or python.exe are found. It masquerades with Google Chrome icons, disables Windows Defender, Firewall and other security services, injects code into msiexec.exe, and resolves .bit Namecoin domains like bookreader[.]bit via hardcoded OpenNIC DNS servers over TCP.
28
UBoatRAT Navigates East Asia
Unit 42 discovers UBoatRAT, a new custom RAT targeting South Korean and video-game industry personnel, delivered via Google Drive with GitHub-based C2 and BITS persistence.
Unit 42 identified UBoatRAT, a new custom remote access trojan first found in May 2017, whose initial version used a public Hong Kong blog service and a compromised Japanese web server for command and control. The latest variants target personnel or organizations related to South Korea or the video games industry, are delivered through Google Drive, and masquerade as Microsoft Word, Excel, or folder icons. The RAT checks for virtualization software and domain join, retrieves its C2 address from a Base64-encoded string in a GitHub-hosted file, uses a custom XOR-encrypted C2 protocol, and maintains persistence via Windows Background Intelligent Transfer Service (BITS) jobs that survive reboots.
44
Bisonal Malware Used in Attacks Against Russia and South Korea
Unit 42 details a Bisonal malware variant, active since 2014, targeting Russian and South Korean defense organizations via PDF-disguised spearphishing emails.
In early May, Unit 42 discovered a campaign delivering a Bisonal malware variant against at least one Russian communications security and cryptography company and one unidentified organization in South Korea. The variant, in the wild since at least 2014, introduces a new C2 cipher and rewritten networking and persistence code, with only 14 samples collected to date. Attackers spoofed Russian state corporation Rostec in spearphishing emails carrying an executable disguised with a PDF icon; the dropper decrypts an RC4-encrypted DLL and establishes persistence via a registry Run key. Bisonal has been used since 2013 against government, military, and defense targets in South Korea, Russia, Japan, and India, alongside successors Bioazih and Dexbia.
48
Analysis of Smoke Loader in New Tsunami Campaign
Fake Japanese Meteorological Agency tsunami warning emails delivered Smoke Loader and AzoRult malware to steal credentials from targets in Japan.
A fake tsunami warning email impersonating Japan's Meteorological Agency asked recipients to click a link on a registered fake agency domain, delivering the commodity loader Smoke Loader to targets in Japan. Smoke Loader, active since 2011, is modular, and its payloads have included banking trojans, ransomware, cryptominers, password stealers, and PoS malware; the campaign later also deployed AzoRult. New samples add junk-jump obfuscation, encrypted network traffic and payload files, a unique machine ID used for tracking and encryption, and PROPagate injection into explorer.exe, with persistence via a Startup folder shortcut and RC4-encrypted C2 communication.
45
Tracking OceanLotus’ new Downloader, KerrDown
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.
52
NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT
Unit 42 links NOKKI malware to North Korea's Reaper group, uncovering the Final1stspy dropper that deploys the DOGCALL RAT in politically motivated attacks.
Unit 42 analyzed the NOKKI malware family used in politically themed attacks against Russian and Cambodian speakers since July 2018. The researchers linked NOKKI to the Reaper group, publicly attributed to North Korea, whose custom DOGCALL RAT uses third-party hosting services to upload data and receive commands. A previously unreported family, Final1stspy, was found deploying DOGCALL, sharing a unique base64-to-hex deobfuscation routine with NOKKI droppers. Attacks used malicious Microsoft Word macros that download and execute payloads while opening decoy documents.
42
The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia
Unit 42 uncovers the Fractured Block campaign using the CARROTBAT dropper to deliver SYSCON and OceanSalt malware in cryptocurrency-themed attacks across Southeast Asia.
Unit 42 identified 29 CARROTBAT dropper samples used in the Fractured Block campaign, delivering decoy documents on cryptocurrencies, exchanges, and Korean political topics. Early samples delivered the SYSCON RAT, which uses FTP for command and control, while later ones dropped the previously reported OceanSalt malware. CARROTBAT supports 11 decoy file formats and uses certutil to download and execute payloads. Initial discovery stemmed from a December 2017 spear phishing attack on a British government agency, with infrastructure overlap tying the campaign to KONNI activity.
42
Cardinal RAT Sins Again, Targets Israeli Fin
Unit 42 documents updated Cardinal RAT attacks against Israeli FinTech firms, using BMP steganography, MD5-hash obfuscation, and process injection to hinder analysis and detection.
Unit 42 tracked a series of attacks using an updated Cardinal RAT (version 1.7.2) targeting the Israeli financial technology sector. The .NET loader hides a second-stage DLL inside an embedded BMP image decrypted with a single-byte XOR key, and the payload renames functions, methods, and variables to MD5 hashes for obfuscation. The malware installs a startup-folder LNK file and injects its final payload into RegSvcs.exe or RegAsm.exe, communicating with affiliatecollective[.]club over port 443. A possible relationship with the EVILNUM JavaScript malware used against similar organizations was also noted.
40
Malspam Targeting Brazil Continues to Evolve
Brazilian malspam campaigns continue evolving, abusing Google URL shortener and Dropbox and using Squiblydoo plus DLL side-loading to deploy likely infostealing botnet malware.
A June 2017 Brazilian malspam campaign spoofed IPTU tax notification emails, using the recipient's address as the sender, and abused Google's URL shortener and Dropbox to deliver a zip containing a malicious Windows shortcut (.lnk) file. The LNK used the Squiblydoo technique (regsvr32.exe) to download and execute a scriptlet with elevated privileges, retrieving a signed G-Buster Browser Defense executable alongside a malicious fltLib.dll loaded via side-loading, likely an information-stealing botnet. Post-infection HTTP traffic exposed over 400 infected Windows hosts, mostly in Brazil, with 2,132 Banload-tagged samples observed in the first half of 2017.
20
55
30
30
42
30
30
30
30
30
30
35
30
30
30
30
30
30
47
55
30
30
30
30
42
42
60
30
42
42
47