Lazarus Group Uses CollectionRAT and DeimosC2 in Enterprise Campaign
Summary
Talos details a Lazarus Group campaign exploiting a ManageEngine ServiceDesk vulnerability and reusing infrastructure to deploy CollectionRAT, DeimosC2 on Linux, and a malicious Plink tool.
Key points
- The North Korean state-sponsored Lazarus Group campaign exploited CVE-2022-47966 in ManageEngine ServiceDesk to deploy multiple threats.
- CollectionRAT is a Windows RAT that gathers system information, runs commands, manages files, downloads payloads, spawns processes, and can remove itself.
- CollectionRAT samples share a code-signing certificate with 2021 samples of EarlyRAT, also known as Jupiter.
- Talos found a DeimosC2 beacon in Linux ELF format, indicating intended use against Linux-based servers for initial and persistent access.
- The group reused infrastructure from a preceding campaign to host malware and command-and-control activity.
- A malicious Plink binary embeds reverse-tunneling commands and creates a mutex to limit the connection to one instance.
- Talos published hashes and network indicators and listed Snort rules and Cisco security products for detection and blocking.
Article Details
- Attack Vectors
- Exploitation of CVE-2022-47966 in ManageEngine ServiceDesk to deploy malware.
- Use of DeimosC2 as an initial and persistent access implant on Linux endpoints.
- Delivery of CollectionRAT and other payloads from reused infrastructure.
- Use of a trojanized Plink binary with an embedded reverse-tunnel command.
- CollectionRAT can execute commands, manage files, spawn processes, and download and deploy additional payloads.
- Defensive Notes
- Cisco recommends using Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, and Cisco Duo protections.
- Keep Snort Subscriber Rule Set rules up to date; the article lists SIDs 62248 and 62253-62255 for this threat.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]61[.]186[.]55 | Listed network IOC; port 443 is specified in the source. |
| IPV4 | 109[.]248[.]150[.]13 | Listed network IOC and reused attacker infrastructure. |
| IPV4 | 146[.]4[.]21[.]94 | Listed network IOC and reused attacker infrastructure. |
| SHA256 | 05e9fe8e9e693cb073ba82096c291145c953ca3a3f8b3974f9c66d15c1a3a11d | Hash of a DeimosC2 implant. |
| SHA256 | 773760fd71d52457ba53a314f15dddb1a74e8b2f5a90e5e150dea48a21aa76df | Hash of a CollectionRAT sample. |
| SHA256 | db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984 | Hash of a CollectionRAT sample. |
| SHA256 | e3027062e602c5d1812c039739e2f93fc78341a67b77692567a4690935123abe | Hash of the trojanized Plink binary. |
| SHA256 | ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6 | Hash of the QuiteRAT malware. |
CVE
People
Threat Actors
Malware
CollectionRATIn addition to their “QuiteRAT” malware, which we covered in the blog, we also discovered Lazarus Group using a new threat called “CollectionRAT.”DTrackphase. Lazarus Group previously relied on the use of custom-built implants such as MagicRAT, VSingle, DTrack, and Yamabot as a means of establishing persistent initial access on a successfully compromised system.EarlyRATBased on our analysis, CollectionRAT appears to be connected to Jupiter/EarlyRAT, another malware family Kaspersky recently wrote about and attributed to Andariel, a subgroup within the Lazarus Group umbrella of threatJupiterBased on our analysis, CollectionRAT appears to be connected to Jupiter/EarlyRAT, another malware family Kaspersky recently wrote about and attributed to Andariel, a subgroup within the Lazarus Group umbrella of threatMagicRATexploitation of the Log4j vulnerability, heavily employed a previously unknown implant we called “MagicRAT,” along with known malware families VSingle, YamaBot and TigerRAT, all of which were previouslyQuiteRATIn addition to their “QuiteRAT” malware, which we covered in the blog, we also discovered Lazarus Group using a new threat called “CollectionRAT.”TigerRATpreviously unknown implant we called “MagicRAT,” along with known malware families VSingle, YamaBot and TigerRAT, all of which were previously attributed to the threat actor by Japanese and Korean government agencies.VSingleheavily employed a previously unknown implant we called “MagicRAT,” along with known malware families VSingle, YamaBot and TigerRAT, all of which were previously attributed to the threat actor by Japanese and KoreanYamaBotemployed a previously unknown implant we called “MagicRAT,” along with known malware families VSingle, YamaBot and TigerRAT, all of which were previously attributed to the threat actor by Japanese and Korean
Vendors
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.ManageEngine ServiceDeskIn the Lazarus Group’s latest campaign, which we detailed in a recent blog, the North Korean state-sponsored actor is exploiting CVE-2022-47966, a ManageEngine ServiceDesk vulnerability to deploy multiple threats.Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.PuTTYcommanding and controlling CollectionRAT, the newest malware in the actor’s arsenal. A malicious copy of PuTTY’s Plink utility (a reverse-tunneling tool) was also hosted on the same infrastructure servingSecure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat: 62248, 62253-62255.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Umbrellafamily Kaspersky recently wrote about and attributed to Andariel, a subgroup within the Lazarus Group umbrella of threat actors.
Tools
3proxyknown to use dual-use utilities in their operations, especially for reverse tunneling such as Plink and 3proxy.Cobalt StrikeC2 framework supporting a variety of RAT capabilities similar to other popular C2 frameworks such as Cobalt Strike and Sliver.DeimosC2One such example of this trend is Lazarus Group’s use of the open-source DeimosC2 framework. The DeimosC2 agent we discovered in this campaign is an ELF binary, indicating Lazarus’ intention to deploy this implantImpackettools such as Mimikatz and post-compromise reconnaissance and pivoting frameworks such as Impacket. However, these tools have primarily been used in the post-compromise phase of the attack. This campaignMimikatzin the compromised enterprise network. These include proxy tools,, credential-dumping tools such as Mimikatz and post-compromise reconnaissance and pivoting frameworks such as Impacket. However, these tools havePlinkand controlling CollectionRAT, the newest malware in the actor’s arsenal. A malicious copy of PuTTY’s Plink utility (a reverse-tunneling tool) was also hosted on the same infrastructure serving CollectionRAT toSliversupporting a variety of RAT capabilities similar to other popular C2 frameworks such as Cobalt Strike and Sliver.
Countries
Industries
Energyin less than a year. In September 2022, Talos published details of a Lazarus Group campaign targeting energy providers in the United States, Canada and Japan. This campaign, enabled by the successful exploitationHealthcarein CISA’s advisory from February 2023 highlighting ransomware activity conducted by North Korea against healthcare and critical infrastructure entities across the world. Kaspersky reported that EarlyRAT is deployed via