ASEC Links Xctdoor Campaigns to Earlier CRAT Attacks in Korea
Summary
ASEC links Larva-26005’s current Xctdoor activity in Korea to earlier CRAT attacks, detailing delivery through disguised installers and LNK files, malware behavior, and suspected ties to North Korean actors.
Key points
- ASEC reports that Larva-26005 has targeted users in Korea with Xctdoor, using disguised security-software installers and LNK files delivered in suspected spear-phishing attacks.
- The installer chain uses DLL side-loading and scripts to download XcLoader and Xctdoor; XcLoader injects Xctdoor into legitimate processes and establishes persistence.
- Xctdoor has C++ and Go variants. Its backdoor functions include command execution, file transfer, process management, keylogging, clipboard monitoring, and screenshots.
- ASEC links current activity to 2020 CRAT cases through shared installation paths, code-obfuscation patterns, and evidence that an early Xctdoor version was used alongside CRAT and Hansom ransomware.
- Earlier cases involved web shells on compromised servers and malicious changes to groupware or ERP software to distribute malware.
- ASEC says recent cases show continued information collection, but no recent ransomware attacks have been confirmed; the actor’s links to North Korea remain an assessment.
Article Details
- Attack Vectors
- Spear-phishing emails and malicious LNK files were used to initiate infections; the LNK files displayed decoy documents while creating and executing scripts.
- Malware was distributed through compressed files disguised as Veraport and SoftCamp installers, using DLL side-loading to execute malicious DLLs.
- In 2024 cases, attackers installed a web shell after compromising an unmanaged Windows IIS server and after exploiting a vulnerable groupware file-upload page.
- A malicious BeeBEEP installer was substituted for the legitimate installer in a groupware system to spread Xctdoor internally.
- A Korean ERP update module was modified to execute a malicious DLL through Regsvr32.exe.
- Earlier CRAT campaigns used spear-phishing Hangul documents exploiting CVE-2017-8291 and tampered programs uploaded to Korean community sites.
- Defensive Notes
- Exercise caution with email attachments and executable files from unknown sources.
- Update V3 to the latest version to help prevent malware infections.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | casinolegit[.]fun | Domain listed by the source as a threat indicator. |
| DOMAIN | hesenorm[.]info | Malware-download domain used to deliver encrypted Xctdoor and XcLoader and a PowerShell launcher. |
| DOMAIN | koramate[.]fun | Domain listed by the source as a threat indicator. |
| DOMAIN | ntsgo-corp[.]com | Domain listed by the source as a threat indicator. |
| DOMAIN | ntsgo[.]name | Domain listed by the source as a threat indicator. |
hansom2008@protonmail[.]com | Email address identified in the Hansom ransomware ransom note as a threat-actor contact. | |
hansompay2008@yandex[.]com | Email address identified in the Hansom ransomware ransom note as a threat-actor contact. | |
| HOSTNAME | www[.]fabioluciani[.]com | Downloader C2 server address cited in a CRAT attack case. |
| MD5 | 01b58f2ff2c14feed46a0768ea46686d | MD5 hash listed by the source as a threat indicator. |
| MD5 | 07766e6e9d9f86775ad564a65af292c1 | MD5 hash listed by the source as a threat indicator. |
| MD5 | 08e19a0d516d14e564359ee111ed2586 | MD5 hash listed by the source as a threat indicator. |
| MD5 | 0d2e61c8a5e6280e065b61e75b848c68 | MD5 hash listed by the source as a threat indicator. |
| MD5 | 12391f66ee33d379108fd649a999e1a0 | MD5 hash listed by the source as a threat indicator. |
| URL | hxxp[:]//casinolegit[.]info/ms/beeLogo[.]webp | URL listed by the source as a threat indicator. |
| URL | hxxp[:]//casinosec[.]info/ms/beeLogo[.]webp | URL listed by the source as a threat indicator. |
| URL | hxxp[:]//desk-azureft[.]info/wp-include/wpmain[.]php | URL listed by the source as a threat indicator. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelCRAT could compress and exfiltrate user files; Xctdoor transmitted collected data to its C2 server.T1053.005 · Scheduled TaskA BAT downloader registered the VBS downloader in Task Scheduler.T1055 · Process InjectionXcLoader injected Xctdoor into a selected legitimate process, or explorer.exe when no process configuration file was present.T1056.001 · KeyloggingXctdoor supported starting and stopping keylogging and transmitting captured keystrokes.T1057 · Process DiscoveryXctdoor could retrieve and transmit a process list.T1059.001 · PowerShellPowerShell commands and a downloaded PowerShell script moved and decoded payload files.T1059.003 · Windows Command ShellXctdoor supported shell-command execution, including multiple commands using cmd /c.T1071.001 · Web ProtocolsCRAT communicated with its C2 server over HTTP.T1082 · System Information DiscoveryXctdoor had a command to retrieve and transmit system information.T1083 · File and Directory DiscoveryXctdoor could retrieve drive information and list files in a specified folder.T1105 · Ingress Tool TransferThe BAT downloader fetched encrypted Xctdoor and XcLoader from the listed download URLs.T1113 · Screen CaptureXctdoor supported taking screenshots and transmitting them.T1115 · Clipboard DataXctdoor transmitted data when clipboard contents changed.T1140 · Deobfuscate/Decode Files or InformationXcLoader and Xctdoor decrypted obfuscated code during runtime; a PowerShell script also XOR-decoded XcLoader.T1204.002 · Malicious FileVictims executed malicious LNK files that dropped scripts and displayed decoy documents.T1218.010 · Regsvr32RegSvr32.exe was used to run XcLoader and to execute a malicious DLL added to an ERP update module.T1486 · Data Encrypted for ImpactThe article reports that Hansom ransomware encrypted infected systems.T1505.003 · Web ShellAttackers uploaded a web shell through a vulnerable groupware file-upload page and installed one after compromising a Windows IIS server.T1547.001 · Registry Run Keys / Startup FolderCRAT registered an LNK file that executed it via RegSvr32 in the Run key.T1547.009 · Shortcut ModificationXcLoader created and executed a shortcut in the startup path for persistence.T1566.001 · Spearphishing AttachmentCRAT was distributed through spear-phishing documents, and later Larva-26005 attacks used phishing emails.T1574.001 · DLLThe disguised Veraport package used ShellRunAs to side-load the malicious credui.Dll; the SoftCamp package loaded RADCUI.Dll through a disguised executable.
CVE
Threat Actors
AndarielThe article cites Andariel attacks on domestic ERP solutions as a similarity to the ERP-modification method; it does not identify Andariel as Larva-26005.Larva-26005ASEC's designation for the threat actor distributing XcLoader and Xctdoor in Korea; ASEC believes the actor is linked to North Korea.Lazarus GroupSecurity firms attributed CRAT attacks to the Lazarus group or reported evidence of a link to it.
Malware
CRATAnalysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)HansomAccording to a Cisco Talos report, the malware installed the Hansom ransomware to encrypt infected systems, and attack cases of the same type were also identified in domestic ASD logs.XcLoader“{Random}.Bat” downloads XcLoader and Xctdoor, while “p{random}.Vbs” downloads the PowerShell script “%PUBLIC%\videos\2.Ps1”.XctdoorAnalysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)
Products
BeeBEEPOne characteristic of this attack case was that the attackers modified the installation file of BeeBEEP, an open-source messenger, to insert a routine that creates and executes Xctdoor, and then replaced the existingShellRunAsThe compressed file disguised as Veraport contains Sysinternals’ ShellRunAs, renamed to “veraport-q3.Exe” to mimic Veraport.SoftCampAlthough the initial distribution method is unknown, the malware was installed via droppers disguised as the security programs Veraport and SoftCamp.V3Also, V3 should be updated to the latest version so that malware infections can be prevented.VeraportAlthough the initial distribution method is unknown, the malware was installed via droppers disguised as the security programs Veraport and SoftCamp.
Tools
Countries
KoreaAhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea.North KoreaSecurity firms that investigated CRAT identified the threat actors as the Lazarus group, and links to other North Korea-based attack cases were also confirmed.