SugarGh0st RAT Campaign Targets Uzbekistan Government and South Korea
Summary
Cisco Talos details a campaign targeting Uzbekistan’s Ministry of Foreign Affairs and users in South Korea with SugarGh0st, a customized Gh0st RAT variant delivered through malicious Windows shortcuts and JavaScript.
Key points
- Talos says the campaign likely began in August 2023 and assesses with high confidence that SugarGh0st is a customized Gh0st RAT variant.
- A malicious RAR archive and Windows shortcut lead to JavaScript droppers; two infection chains decrypt and launch the RAT, one using DLL sideloading and the other DynamicWrapperX and shellcode.
- Lures include Uzbek- and Korean-language decoy documents; the Uzbekistan sample likely reached a Ministry of Foreign Affairs employee through phishing.
- Talos assesses with low confidence that a Chinese-speaking actor operates the campaign, citing artifacts in samples and document metadata.
- SugarGh0st can log keystrokes, run arbitrary commands, access files and services, capture screenshots, and clear Windows event logs.
- The malware communicates with hardcoded C2 domains and sends system information; Talos published detection resources, including Snort SID 62647 and ClamAV signatures.
Article Details
- Attack Vectors
- A likely phishing email delivered a malicious RAR archive to an employee of Uzbekistan's Ministry of Foreign Affairs. The archive contained a Windows Shortcut (LNK) that dropped and executed a JavaScript dropper.
- The JavaScript dropper extracted decoy documents, an encrypted SugarGh0st payload, and supporting files. In one chain, a batch script used a copied rundll32.exe to sideload a DLL loader that decrypted and reflectively loaded the payload.
- In a second chain, JavaScript used the DynamicWrapperX ActiveX component to run shellcode that decrypted and reflectively loaded SugarGh0st into dllhost.exe.
- The second chain created a Run registry entry for persistence, with the subkey name CTFMON.exe.
- Defensive Notes
- Cisco Talos recommends Cisco Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, Cisco Duo, and Snort protections for detecting or blocking activity associated with this threat.
- ClamAV detections listed for the threat include Win.Trojan.SugarGh0stRAT-10014937-0, Win.Tool.DynamicWrapperX-10014938-0, Txt.Loader.SugarGh0st_Bat-10014939-0, Win.Trojan.SugarGh0stRAT-10014940-0, Lnk.Dropper.SugarGh0stRAT-10014941-0, Js.Trojan.SugarGh0stRAT-10014942-1, Win.Loader.Ramnit-10014943-1, and Win.Backdoor.SugarGh0stRAT-10014944-0.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | account[.]drive-google-com[.]tk | C2 domain used by SugarGh0st. |
| DOMAIN | login[.]drive-google-com[.]tk | C2 domain used by SugarGh0st. |
MITRE ATT&CK
T1005 · Data from Local SystemSugarGh0st searches, copies, moves, and deletes files on the victim machine.T1021 · Remote ServicesSugarGh0st provides reverse-shell access to the C2 server.T1055 · Process InjectionShellcode performed process injection, and SugarGh0st was reflectively loaded into the dllhost.exe process.T1056.001 · KeyloggingSugarGh0st includes a keylogging function that writes captured keystrokes to WinLog.txt.T1059.003 · Windows Command ShellA batch script ran the dropped DLL loader.T1059.007 · JavaScriptThe LNK-triggered JavaScript dropper was executed using cscript.T1070.001 · Clear Windows Event LogsSugarGh0st clears the Application, Security, and System event logs to hide malicious activity.T1113 · Screen CaptureSugarGh0st captures screenshots of the victim machine and can send them to the C2 server.T1125 · Video CaptureSugarGh0st can access the infected machine's camera.T1204.002 · Malicious FileThe infection chain began when a victim opened a malicious Windows Shortcut file.T1547.001 · Registry Run Keys / Startup FolderThe second infection chain created a CTFMON.exe subkey under the current user's Run registry key to establish persistence.T1566.001 · Spearphishing AttachmentThe likely initial vector was a phishing email with a malicious RAR archive attachment.T1574.002 · DLL Side-LoadingA copied rundll32.exe was used to sideload the customized DLL loader.
People
Malware
Vendors
Products
Microsoft accountseemingly distributed in South Korea. The decoy document named “Account.pdf” was forged as a Microsoft account security notification for confirming an account registration with a generated password. AnotherMicrosoft WindowsWe observed two infection chains leveraging Windows Shortcut embedded with malicious JavaScript to deliver the components to drop and launch the SugarGh0st payload.
Tools
cscriptlocation. After that, the dropped JavaScript is executed using the living-off-the-land binary (LoLBin) cscript. DynamicWrapperXRAT payload, the customized variant of the Gh0st RAT. Another infection chain leverages the DynamicWrapperX loader to inject and run the shellcode that decrypts and executes SugarGh0st. regsvr32C:\Windows\system32\regsvr32 /i /s C:\Users\ADMINI~1\AppData\Local\Temp\libeay32.dllRundll32the JavaScript executes the batch script to run the dropped DLL loader by sideloading it with a copied rundll32. The DLL loader will decrypt the encrypted SugarGh0st payload in memory and run it reflectively. Wscript.exea DLL called “libeay32.dll” and the decoy document. The JavaScript opens the decoy document and copies Wscript.exe to the %TEMP% folder as dllhost.exe. It runs the dropped JavaScript again using the dllhost.exe and