Authorities and telecommunications sectors in Southeast Asia have turn out to be the goal of a “subtle” marketing campaign undertaken by a brand new superior persistent risk (APT) group known as Earth Kurma since June 2024.
The assaults, per Pattern Micro, have leveraged customized malware, rootkits, and cloud storage providers for information exfiltration. The Philippines, Vietnam, Thailand, and Malaysia are among the many outstanding targets.
“This marketing campaign poses a excessive enterprise threat attributable to focused espionage, credential theft, persistent foothold established by kernel-level rootkits, and information exfiltration by way of trusted cloud platforms,” safety researchers Nick Dai and Sunny Lu mentioned in an evaluation printed final week.
The risk actor’s actions date again to November 2020, with the intrusions primarily counting on providers like Dropbox and Microsoft OneDrive to siphon delicate information utilizing instruments like TESDAT and SIMPOBOXSPY.
Two different noteworthy malware households in its arsenal embrace rootkits comparable to KRNRAT and Moriya, the latter of which has been noticed beforehand in assaults aimed toward high-profile organizations in Asia and Africa as a part of an espionage marketing campaign dubbed TunnelSnake.
Pattern Micro additionally mentioned that SIMPOBOXSPY and the exfiltration script used within the assaults share overlaps with one other APT group codenamed ToddyCat. Nonetheless, a definitive attribution stays inconclusive.
It is at present not referred to as to how the risk actors achieve preliminary entry to focus on environments. The preliminary foothold is then abused to scan and conduct lateral motion utilizing quite a lot of instruments like NBTSCAN, Ladon, FRPC, WMIHACKER, and ICMPinger. Additionally deployed is a keylogger known as KMLOG to reap credentials.
It is price noting that using the open-source Ladon framework has been beforehand attributed to a China-linked hacking group known as TA428 (aka Vicious Panda).
Persistence on the hosts is completed by three completely different loader strains known as DUNLOADER, TESDAT, and DMLOADER, that are able to loading next-stage payloads into reminiscence and executing them. These encompass Cobalt Strike Beacons, rootkits like KRNRAT and Moriya, in addition to information exfiltration malware.
What distinguishes these assaults is using living-off-the-land (LotL) methods to put in the rootkits, the place hackers make use of legit system instruments and options, on this case, syssetup.dll, relatively than introducing simply detectable malware.
Whereas Moriya is engineered to examine incoming TCP packets for a malicious payload and inject shellcode right into a newly spawned “svchost.exe” course of, KRNRAT is an amalgamation of 5 completely different open-source tasks with capabilities comparable to course of manipulation, file hiding, shellcode execution, visitors concealment, and command-and-control (C2) communication.
KRNRAT, like Moriya, can also be designed to load a user-mode agent the rootkit and inject it into “svchost.exe.” The user-mode agent serves as a backdoor to retrieve a follow-on payload from the C2 server.
“Earlier than exfiltrating the information, a number of instructions executed by the loader TESDAT collected particular doc information with the next extensions: .pdf, .doc, .docx, .xls, .xlsx, .ppt, and .pptx,” the researchers mentioned. “The paperwork are first positioned right into a newly created folder named “tmp,” which is then archived utilizing WinRAR with a particular password.”
One of many bespoke instruments used for information exfiltration is SIMPOBOXSPY, which might add the RAR archive to Dropbox with a particular entry token. Based on a Kasperksy report from October 2023, the generic DropBox uploader is “in all probability not completely utilized by ToddyCat.”
ODRIZ, one other program used for a similar function, uploads the collected data to OneDrive by specifying the OneDrive refresh token as an enter parameter.
“Earth Kurma stays extremely lively, persevering with to focus on international locations round Southeast Asia,” Pattern Micro mentioned. “They’ve the potential to adapt to sufferer environments and keep a stealthy presence.”
“They’ll additionally reuse the identical code base from beforehand recognized campaigns to customise their toolsets, typically even using the sufferer’s infrastructure to attain their targets.”
