Talos Traces Aviation-Targeting Malware Activity to a Threat Actor Active for Years
Summary
Talos linked aviation-themed campaigns using AsyncRAT and njRAT to an actor active since at least 2013, tracing domains, handles, crypters, and infection chains. Researchers assess the actor is likely based in Nigeria.
Key points
- Talos says the actor targeted the aviation industry from at least 2018, while running malware campaigns for years before that.
- Aviation-themed lures delivered VBS files, including through links in emails and Google Drive; the scripts acted as crypters for AsyncRAT.
- The research also traced njRAT and other remote-access malware, detailing a multistage chain involving malicious Publisher documents, macros, mshta, PowerShell, and AMSI patching.
- Researchers connected activity through overlapping C2 domains, malware identifiers, forum handles, crypter use, and other infrastructure, while cautioning that some links were low-confidence.
- Talos assesses with high confidence that the actor is based in Nigeria and used off-the-shelf malware and purchased crypters rather than developing custom malware.
- The report warns that smaller, persistent operations can enable credential and cookie theft and create risk of larger follow-on attacks.
Article Details
- Attack Vectors
- Emails targeting the aviation industry used aviation-themed lures and links to malicious VBS files hosted on Google Drive.
- Malicious Microsoft Publisher documents used macros to extract embedded data, download HTML from a C2 server, and invoke mshta to execute a VBScript stage.
- The VBScript stage ran PowerShell to download further payloads, including a PowerShell stage hosted at a specific GitHub Pages URL.
- Some campaigns used malicious documents to download and execute payloads; crypters were used to wrap RATs and evade detection.
- Defensive Notes
- The article recommends blocking malicious email and web traffic and detecting or preventing malware execution with Cisco Secure products.
- Cisco Secure Email can block the malicious emails; Cisco Secure Web Appliance can block malicious websites; and Cisco Secure Endpoint is described as suited to preventing execution of the malware.
- The article identifies Snort Subscriber Rule Set SIDs 58083-58088 for detecting this threat.
- Cisco Secure Endpoint users can use Orbital Advanced Search to check endpoints for this threat.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 8970[.]ddns[.]net | Listed in the article's IOC domain list for the campaign. |
| DOMAIN | akconsult[.]linkpc[.]net | Threat-actor-associated domain used for C2; samples with aviation-related names communicated with it. |
| DOMAIN | bodmas[.]linkpc[.]net | Threat-actor-associated domain contacted by samples using the Aspire crypter and CyberGate. |
| DOMAIN | e29rava[.]ddns[.]net | C2 domain linked to AsyncRAT samples and aviation-themed VBS files. |
| DOMAIN | exchangexe2021[.]ddns[.]net | Listed in the article's IOC domain list for the campaign. |
| DOMAIN | frankent2021[.]ddns[.]net | Listed in the article's IOC domain list for the campaign. |
| DOMAIN | groups[.]us[.]to | Domain used as C2 by malware samples, including an H-Worm sample. |
| DOMAIN | hoc2021[.]ddns[.]net | Listed in the article's IOC domain list for the campaign. |
| DOMAIN | jorigt95[.]ddns[.]net | Listed in the article's IOC domain list for the campaign. |
| DOMAIN | kimjoy[.]ddns[.]net | Domain associated with the aviation campaign and AsyncRAT activity. |
| DOMAIN | monthending[.]duckdns[.]org | Listed by the researchers as an IOC and linked to the actor's malicious activity, though not investigated in depth. |
| DOMAIN | nextboss[.]ddns[.]net | Listed in the article's IOC domain list for the campaign. |
| DOMAIN | opybiddo[.]zapto[.]org | C2 domain used by a CyberGate sample associated with the actor. |
| DOMAIN | reserverem[.]duckdns[.]org | Listed by the researchers as an IOC and linked to the actor's malicious activity, though not investigated in depth. |
| DOMAIN | shugardaddy[.]ddns[.]net | Listed in the article's IOC domain list for the campaign. |
kimjoy44@yahoo[.]com | Email address the researchers associated with the threat actor. | |
| SHA256 | 03590bca5c249fff42c5bacef39bd308c91f8630a1a19386bed3d469f99864ac | Sample hash listed in the article. |
| SHA256 | 04ea078080a913511d938455a2ea0bfce88597499bf791a99d8561f8870da627 | Sample hash listed in the article. |
| SHA256 | 083217a2f03d5c9b0a8e3371afda4c6dd2402ac98d0199aee9729a4e604db603 | Sample hash listed in the article. |
| SHA256 | 096cf7af0363489cba18a567f535f3c79cb918226563402ebfa4288d7f4f88e9 | Sample hash listed in the article. |
| SHA256 | 0a53710820d1c060c6d46946c81417b4294898accc31c847a027c5622b7afbcb | Sample hash listed in the article. |
| SHA256 | 0b119b80a5676021afd368da94527fc9fe717e2abf5d94574d29bec307251483 | Sample hash listed in the article. |
| SHA256 | 0b3f6114a06812ec6676c730de23fd0a60b15b73210ac1151417353bcf7785aa | Sample hash listed in the article. |
| SHA256 | 0bbdae8713cdbb85ed8508140cc98c15c13fa8a82403d5ce848737d18491673a | Sample hash listed in the article. |
| SHA256 | 0c8b4a611d635d0c3fd224562f334b9b0798697af52961ed0e7537413b608830 | Sample hash listed in the article. |
| SHA256 | 0caea3fdb7fbd02733441a5e54c1b03694e2203119dd1ff2affd85ca65d76d23 | Sample hash listed in the article. |
| SHA256 | 0d04d8a74c4bdb7401e91bff73955738788901724d73b6c42272aa188e1cd72c | Sample hash listed in the article. |
| SHA256 | 0ea350d81b1fde31efdace2a3a96d3bacd6da7dc972723542e1de2dfd64e79a9 | Sample hash listed in the article. |
| SHA256 | 0f05e24cc77952658e111c0bb2bf8236fd38d2e1ed90ea9e57e53c13e89275ff | Sample hash listed in the article. |
| SHA256 | 108deaea533c59386bc4c8c7fbade8f1e42e629908bd516ac2a6aa45cb854ff0 | Sample hash listed in the article. |
| SHA256 | 1103019f32dd745bffa5319de5a18c5ebc50425f5ec102a436a7de665e6b1553 | Sample hash listed in the article. |
| SHA256 | 13ad9c1755d39149c1b643f0e5d2935aad54e9e9754052572bd055056523d905 | Sample hash listed in the article. |
| SHA256 | 1a4e182914a3be535bdde75f9a41eef106da3113dc4c683a6bcfc45c986d101a | Sample hash listed in the article. |
| SHA256 | 1a8a77b55f521ca9770e3ad465e1414d74651df2dc9281988a05ad5d0cbe8769 | Sample hash listed in the article. |
| SHA256 | 1c6978501bc6f92d9c351315640d1ebbb109bfab7bde9df2db11fa47d9fc574f | Sample hash listed in the article. |
| SHA256 | 1e9033edd37c1115a798e5e8a90f880025f2f7304769d86ff42e88ec90c2f5b1 | Sample hash listed in the article. |
| SHA256 | 2192ed71606de24f8def847e758ab2415525edf8a2236cec71fc8f5393c1f80c | Sample hash listed in the article. |
| SHA256 | 281e900c100ad29ef512c1c188800cbdf9c85166bc24a419583f2677b1c6fd23 | Sample hash listed in the article. |
| SHA256 | 288c2b8a892fccff6fb94aeb90ae791322892d5ac1949f19f71b1664edc19c28 | Sample hash listed in the article. |
| SHA256 | 2a5fc364ad77f25a6655467a3b07a6cb99ece0b266a582df0de7724de2473da6 | Sample hash listed in the article. |
| SHA256 | 2da3c027d41c6b3f913a9a21920ba6a5e5c562a3301c8a1410927a6ee039bdd2 | Sample hash listed in the article. |
| SHA256 | 2f878e7c5238448f04422067ca97bcebd5e105886a9542ac1a2ea21e42355f9f | Sample hash listed in the article. |
| SHA256 | 3123f70fb616717c44599477734e0dd0aaa7efc1060d755bd6bd8f7ec89f6fb5 | Sample hash listed in the article. |
| SHA256 | 33a5ff49f019f2dcf8a400b3f98c5eb239078b7fb64302e22dd48ce50b0b344a | Sample hash listed in the article. |
| SHA256 | 3566eeab1656ef8cc3f7ab32b1d13c256747a57a0d47cd8cfc37b7d4dc38061b | Sample hash listed in the article. |
| SHA256 | 36c0408a369712bdf6b905849d5b8e3628dcaa903e9829378466a838f2265746 | Sample hash listed in the article. |
| SHA256 | 39b89bdc998fc9cb3c936b03156c1f185eaeec659ebabeac7b4fcb74bd75847d | Sample hash listed in the article. |
| SHA256 | 3dc81cbb98731bdfe2b4caba9875129475c3fa101f6d458ed79185ada5eac4fd | Sample hash listed in the article. |
| SHA256 | 4077f8d706a2d7cbd453f522d55e88cc7f90e84783510fa56000d800719f1852 | Sample hash listed in the article. |
| SHA256 | 4155f4a9d33c08e9ab0d38648930591de5c5376b3b1d551b0e16047d3648e021 | Sample hash listed in the article. |
| SHA256 | 42056770d4c7fec72a529126c4c727c715171295ea68e8f39a3b25e835c9c4a0 | Sample hash listed in the article. |
| SHA256 | 423b5645f797efdb72ce0e973e0c0d1b166a6b74b497b2a0e791405fb09683d8 | Sample hash listed in the article. |
| SHA256 | 4309e6dc5f9633106714d1a16f9300641d45d5062f5456cfb836d4e6d24ace95 | Sample hash listed in the article. |
| SHA256 | 43ccf1bf3334c7238b2fbc8ab9192859eccf7535a43332f2fc16e710a2123863 | Sample hash listed in the article. |
| SHA256 | 45a271892d1547013ff384d9f1c31195973d6513cd856175cef1cbdbee283a72 | Sample hash listed in the article. |
| SHA256 | 4870db29a47060a2a76a3d27ab4d60ae837b221f85f218a8c0fb7eb2d2525696 | Sample hash listed in the article. |
| SHA256 | 494e877644452516700834e3599b21a0916d80eef7eaefdbecdb1409e4b5f90d | Sample hash listed in the article. |
| SHA256 | 4ad69083be6c8550af2cb9e9ac749d7c3439d71b542891238a6c749f393a00d5 | Sample hash listed in the article. |
| SHA256 | 4bce32e4f456767257a25646a70a370f5c40668c79f7a9f0aecabeddbe6dd795 | Sample hash listed in the article. |
| SHA256 | 4da2395efa22de5392cb6e4477f5c78d45f63feafa567960dd34cf7c0470b4ed | Sample hash listed in the article. |
| SHA256 | 4defaa009bec775363b8d8878e592f3928333674d2cbe667e0a279367d6b62a1 | Sample hash listed in the article. |
| SHA256 | 4e3358f2c55a09345d65387f5f85ff330ddc18ec9223b773c32990433ae3cd57 | Sample hash listed in the article. |
| SHA256 | 4ea27173db2122ae4196e498c3149017aed3598494290b6f3de9aa81e3bfbef1 | Sample hash listed in the article. |
| SHA256 | 4f507144c8cd77b7e2f47c9c858ea90f9374b0303fa32eabaeb5221cf954f9dd | Sample hash listed in the article. |
| SHA256 | 50c40dfeb02b23c2dc70cad821b22a7471a5cc87497b4a6abd8efc284a76e7e8 | Sample hash listed in the article. |
| SHA256 | 51c548b34c112b336d9e951942ae64ac46747147c2c618e86e6880726931e3a3 | Sample hash listed in the article. |
| SHA256 | 554daca78ae1578a4cf518079111961d36eb9e77aad70f659eec521d0d6ef4c7 | Sample hash listed in the article. |
| SHA256 | 5571b920ae6916b848cd5d543aad4799093583160ea44248b1a7e03c9222fe9d | Sample hash listed in the article. |
| SHA256 | 55a1585d2deaee3dea3bcf83fee889ab9f312575d9974d09f001927ca3bfe869 | Sample hash listed in the article. |
| SHA256 | 5ad602845c426878cdea8c4fec4b2a09e3d2a9f19cf89f2c26b0543a64c67b2d | Sample hash listed in the article. |
| SHA256 | 5b2dc2be60ce4e2b45f56c7e948d4cbf992bf03b491f88e9b38ba59451e94e91 | Sample hash listed in the article. |
| SHA256 | 5c4584bbe2f314fd016b3887b57a2ad2b1d7cf963adaf74323967fb75d777fc3 | Sample hash listed in the article. |
| SHA256 | 5ceaef4f19760db61a8537fe32f0edc51035c08f96f5bc744b32673956436139 | Sample hash listed in the article. |
| SHA256 | 5dcc73e97d260e969d28796b8627de32b248fe15e8688e6d62fe7bbdc2dd921c | Sample hash listed in the article. |
| SHA256 | 5f037d9a6d3232b001d501328a679dd7966b61e70de6a89ca03ede1818fc120e | Sample hash listed in the article. |
| SHA256 | 623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772 | Sample hash listed in the article. |
| SHA256 | 6385e64dce8e5cc723fba17edfddc8df6ba18ba2a05b5dd60ac474efb445789b | Sample hash listed in the article. |
| SHA256 | 64ad814038c37cd199b1612c22329244a66d8fca4a0f9953cdd3d1b1ee7b2f95 | Sample hash listed in the article. |
| SHA256 | 65ca4e932133e8758c5f177ad6043b6a2d672b19eec3218019c53b3b46bf3fab | Sample hash listed in the article. |
| SHA256 | 68f7e8b9a1a4b69ebe4fb7a5b57b890bd006e5eebaca1337eeca99f8f2d4b745 | Sample hash listed in the article. |
| SHA256 | 69642f95f35b3d14f1123de60819e66e59c8f125defb58d23b8766f498597de3 | Sample hash listed in the article. |
| SHA256 | 6b1db53cbd5dade029bac0a6c54f2d30b6c1579f39a345e7d72383ea7bc4f38c | Sample hash listed in the article. |
| SHA256 | 6b642a070211563273f3ed151103c6e8c52df29e094a28624ff57af05fb8eb22 | Sample hash listed in the article. |
| SHA256 | 6b6d52d0f98ac22702ec61144ebd27552f939dadf10a835f995328c0789668ca | Sample hash listed in the article. |
| SHA256 | 6d8d882611849b0e7ebbe464497c052fe027479f6814618457c9f0fa7724dac2 | Sample hash listed in the article. |
| SHA256 | 6edf51f455af63a82726d573a00b2b55c1086ee803991a063e5832c65fb3c790 | Sample hash listed in the article. |
| SHA256 | 6f52ecef23b4bd9b600ceecd4017a896499bee94cb28320d0828ecf84deedd45 | Sample hash listed in the article. |
| SHA256 | 71a7e0e7e1a13de9cd9ea55220196f7d4a9e928ed433c1dc6e257c49bb5c7f56 | Sample hash listed in the article. |
| SHA256 | 72db243b5873aced1d539c01fd36e162cc84e72767508ce080af4ce89e3bf68c | Sample hash listed in the article. |
| SHA256 | 739bc1cf80e017d48165fac50f95663c602587fbe3b6102db7724bfff39f825b | Sample hash listed in the article. |
| SHA256 | 77f2a568d727a29761d4f9aa23b092ffb614f7a7533399fbc8bf45b2cbb84d13 | Sample hash listed in the article. |
| SHA256 | 7b52362ef06d1a8ec159d5fb0b2f81d3ed760102eaea86480b34292b480012d2 | Sample hash listed in the article. |
| SHA256 | 7cfa61d907f8ee9dd1d943559e59227f58d862a2705b7f673ac302f22fad4803 | Sample hash listed in the article. |
| SHA256 | 7e3cd407085c39e851eadc767a0d78443dd7fea16a919babe9dfd78e26d13c90 | Sample hash listed in the article. |
| SHA256 | 7eedc9a8b30e105c9d37f05ee94769778e7b02eb568847b0fe347d98d5caf026 | Sample hash listed in the article. |
| SHA256 | 7fc3b7342be53bb3933bbc9e69b3b841bf3618896a41fdf187d7b478f96e9e0b | Sample hash listed in the article. |
| SHA256 | 81a058522752f8f11c5045ab81b70e673f79cc0504a9f1a565f324336064a3b7 | Sample hash listed in the article. |
| SHA256 | 83fcedc7c7581294bfe9f19fc6c400d8cd29eda746904e18c5b687d3560e2cca | Sample hash listed in the article. |
| SHA256 | 8437510b14bef4d0c535dba910e1c20df0ae3a11284a44f5e1fa432accb0363e | Sample hash listed in the article. |
| SHA256 | 8487084cac1881bc38d783df932733f4607704f30a0b7a9f6fbcec58902510ff | Sample hash listed in the article. |
| SHA256 | 853ff0fa8a56c24ddd6db57f781921d2b205fa099acbfb6a23ce418e1c227307 | Sample hash listed in the article. |
| SHA256 | 858f83bf5fbc4eaf6900d3a481f23caf0c71519a5bd949506db04853a5847f44 | Sample hash listed in the article. |
| SHA256 | 87c7c23ff999c80b081423d40721ee44b8bf037d26d3452030b8a0f19837f27f | Sample hash listed in the article. |
| SHA256 | 881b95b9064783c072f033052faca44fa4d53193a1f6ce9f754e77a68c2a7b71 | Sample hash listed in the article. |
| SHA256 | 88db2afc4b8b21fc9be21f9960e573fe8794562f4e9d952a73ed808aa8961c4d | Sample hash listed in the article. |
| SHA256 | 8986a01fa210c49c7b51d206a83e2cf1f6bc69bc4dc4a346b0681408e58791e3 | Sample hash listed in the article. |
| SHA256 | 8b588bf5db57e8a9e4d50d62bffd0cfd154158c882533388f9e74fb26ea8d69e | Sample hash listed in the article. |
| SHA256 | 8cbfaa1999cc16fc5f710a6427d2bab89ac62d678a50af17664c8907aad9cf23 | Sample hash listed in the article. |
| SHA256 | 8e655b359f96de6f88fdb2076ca78110c3b0eb77f918e8e99a4d7751ed112a7a | Sample hash listed in the article. |
| SHA256 | 9024b2348e6bdba41cf7979fd09150b6311f3abd4e3eb3acbf86b259dbbf2a4f | Sample hash listed in the article. |
| SHA256 | 907ab14013ca5b760d2a16082b315bdfc54b4e9d44985d8cfb23fa43bc719cc8 | Sample hash listed in the article. |
| SHA256 | 91377c7c09980e48c2c7aba5a3a66d71c9c6c471ca2dc02a186c7c9e72841438 | Sample hash listed in the article. |
| SHA256 | 940629870cba0bceef555d6b05238c3684a6954399b5a05fd2d2678a889eb8b5 | Sample hash listed in the article. |
| SHA256 | 948b3e9997588c5fa92cf17ea3606d621ab0fdb3a41f568c42b0d03f3112a676 | Sample hash listed in the article. |
| SHA256 | 94a3b5867d9804f89ea9c1fc8581ba56c83a80f0e77491a380a919377c79af57 | Sample hash listed in the article. |
| SHA256 | 9881308b05c089b44390def980246fc830b67203b963d537358db157e9dfb4fe | Sample hash listed in the article. |
| SHA256 | 9cd0186792e78c9f625255402fd784325b213ecbb16d53a62e3baf7c2faefdd5 | Sample hash listed in the article. |
| SHA256 | 9dbe3ad48a5c30ec5061da57a52a845129e2042e67ebb950f34b0465fa0b5387 | Sample hash listed in the article. |
| SHA256 | 9e94d03c8af6ca9d5ea7cfbf481970c615d0831452fe0edb2a8abcae8c190693 | Sample hash listed in the article. |
| SHA256 | 9ed430d3d6468cd2858d36cc9aa100b0c216a2778975ade55ac7f5dc6792d584 | Sample hash listed in the article. |
| SHA256 | 9fdd7fa506d1cecb650611897e8172e63e50486c002356eae490a2066141fd2c | Sample hash listed in the article. |
| SHA256 | a03fd6e9683d8f48234081d994c8b2dc8ecd132004210894c0c7b4ed97f03208 | Sample hash listed in the article. |
| SHA256 | a1e95c6769d83724dc68855540805d53ba1a1791c19c68aa176463ba376165e2 | Sample hash listed in the article. |
| SHA256 | a3f943c77562107b681f066faa9c06001220c37ca48f1212a6e04ad27bc645de | Sample hash listed in the article. |
| SHA256 | a41f3fe5481ea0c32d5a0eaf0706415cceed74075c9c752b1ccb402b04a96730 | Sample hash listed in the article. |
| SHA256 | a4d093b5b4825d7d30d64f6a4ba80a2b1079e688ac1a576bdb3d082ff44eaec8 | Sample hash listed in the article. |
| SHA256 | a85919e8611fd1368c4e125a0663e30cd457ca98328b8e4d1940fbb330ea5738 | Sample hash listed in the article. |
| SHA256 | ab3b4397c9e95f9b894c89a8ddda3401ee04526336d497a8c0ee12f89f3710a3 | Sample hash listed in the article. |
| SHA256 | ace6e1274963d34ec4f01b6a74dfb23cb0733daed1abd0611e7ac4ac7e5c8ceb | Sample hash listed in the article. |
| SHA256 | b39eb6aca148f2e3fb491ef8bbfae6f3ea054a7894b36b431d4fb9a86a6be9d1 | Sample hash listed in the article. |
| SHA256 | b3d3a285e35cba08647173ca33aa0744834f91b2af6ba95a374b8c8b89f83b35 | Sample hash listed in the article. |
| SHA256 | b536b2e629251420a9cd824acd7e955540258c78ae7a14b10a787caee251dd40 | Sample hash listed in the article. |
| SHA256 | b6b83a3aa0dd0a9bad132e432c6e8233d796ca6b1b1b831f1a94b7f3fc46ca1e | Sample hash listed in the article. |
| SHA256 | b8412bb181f81254ea35558460f35867ed2e0d6bc59b0c7086124187b8ed01b4 | Sample hash listed in the article. |
| SHA256 | b9e112ad02d419897d298b651a7d1eff532ffbcff0a49514754621422159f02a | Sample hash listed in the article. |
| SHA256 | bbee4612529f7d934954d18b7571522a7045a05457179f83e669f8b4fce10231 | Sample hash listed in the article. |
| SHA256 | bd84d6decb2f5405d0459a1aefe08f9d7634a4262365ceb2cd3b1a033e9c9313 | Sample hash listed in the article. |
| SHA256 | bef717e1da549e205bf88459c537cc22bbd381d24769f399eaa49521df1b9908 | Sample hash listed in the article. |
| SHA256 | c278e70ee10d071ee23868d91628071bb87654c299804b90e4b07b2780c2e070 | Sample hash listed in the article. |
| SHA256 | c2efcc8fa76a41d46b7503cdfbbac52f59280fbbfa10ffe974af0b4edcf57c0f | Sample hash listed in the article. |
| SHA256 | c320c2809e8b986fb4ac9db15bacd6a0f04e298b6be5d77d43099f94e8c51ca9 | Sample hash listed in the article. |
| SHA256 | c3f78dea78b0ce6bed19c3c6d160758a8fd8b3f41e0d60211396eb88d856ab9d | Sample hash listed in the article. |
| SHA256 | c6c6fa1e4521fc4815023611e041377d1722bbb363f6af3c0d91ed216fe5c594 | Sample hash listed in the article. |
| SHA256 | c9e2452b4d231ce272ea3b0b887de1a6b0ddf8c68149953cf3e69866d5a9875c | Sample hash listed in the article. |
| SHA256 | cae455e2cfdcefa11ee64beba30ebbec180490a0f452afcc0e00733d5ff1d944 | Sample hash listed in the article. |
| SHA256 | cb981f01466ade4d1523068432875454e8fecb303ea56ef241ac5df51ba349c9 | Sample hash listed in the article. |
| SHA256 | cd67795d0f8c61ab6269abd53f2bacb2d9d0ae7bcf00ffaba9b8794b9ac2440c | Sample hash listed in the article. |
| SHA256 | cf433da0d2dbbbb026ab3feb9b6b7d44fd681ae33e56da6d41df7e3f6f2c4c46 | Sample hash listed in the article. |
| SHA256 | cfdf291f05acac3bc6a60ab7e20574bfa745a56ea2a0e7c74e3ffee8b38427ca | Sample hash listed in the article. |
| SHA256 | d515a54643d4e324938d2f9ae5d66491f3ed76c2045b681237b844bda801e2f3 | Sample hash listed in the article. |
| SHA256 | d576d9e98452ac972fce6f787353f59587732aac6be8bd948fe38b4c23bbe682 | Sample hash listed in the article. |
| SHA256 | d75818826396ad035834ffc9bbf5f59ad811c21ab6a0bba17911bf59b131b0ad | Sample hash listed in the article. |
| SHA256 | d8c1ccb824ce06a0374f673803bb6247e364145984d25feeb61ae4cbbaa87861 | Sample hash listed in the article. |
| SHA256 | d9bb02f1636ce3e2ad9a4113c3fa9510e5292bf0f63977c5c9e64952930bba54 | Sample hash listed in the article. |
| SHA256 | da2e63cd0e4e23fa018d771a158189ce8d40756633c073695e5c1cffc50d7601 | Sample hash listed in the article. |
| SHA256 | da4b4d0a00b1ea3d81d5fe360dcac86a120ed96617ffc067151c09ff72ff3e45 | Sample hash listed in the article. |
| SHA256 | da79ff6d4487b461ed320011d552ef3ed4d1b1633ec4c51e91702401d0cf221e | Sample hash listed in the article. |
| SHA256 | db6356982c1b324e7e89336abb544b93e9fa3b09b0d1a8fcdfaa22527a5cf66d | Sample hash listed in the article. |
| SHA256 | e403fa45fff2bac7c2c5dfe6dd76eef07c4a707a75ce78ecd17721c931b49f66 | Sample hash listed in the article. |
| SHA256 | e45b917d7b153fa59545b2cbb3c6437d5820aa80b5718946df1bd10401ea39b6 | Sample hash listed in the article. |
| SHA256 | ed007a0a9c9f151652cdb12d82ad500023f001c77cb56acf9c2de44b272e8718 | Sample hash listed in the article. |
| SHA256 | ed2645b0898b4ee7f05d140f1a06ac846fd3029116d020093575b92803468add | Sample hash listed in the article. |
| SHA256 | eee171c3351b6772dc32ac7cf99b95753533ba42dc941034b22be674444a39ff | Sample hash listed in the article. |
| SHA256 | f0565b2e110812686c2eb4ac4cfb0fef390b9bb4ce989b58321dcf5797ae7656 | Sample hash listed in the article. |
| SHA256 | f72f70885f5d9d3ce506127606712aa6784cc9ae9a8f7c4375ca430d268027b7 | Sample hash listed in the article. |
| SHA256 | f81a37d816c639fd977d7781f7fe54cc51e2e34aa3bb8bc877c74ae140025003 | Sample hash listed in the article. |
| SHA256 | fa04dec727fa5606216775030ca542478acdbb2ebaceae945167d152bbd19a55 | Sample hash listed in the article. |
| SHA256 | fa1c7b13454ab1857da9a6d6e69fdf328b3f13be7c700e8fa1435bce29abdd25 | Sample hash listed in the article. |
| SHA256 | fb11743c878695af326b0082709abac83a45a520545d455a1fc7c2bdb7877894 | Sample hash listed in the article. |
| SHA256 | ff8c018ecabac99723b1851b1a50cab79629fce9151ed8ee5a1a2316f5d2ec88 | Sample hash listed in the article. |
| URL | hxxps[:]//satlahlk[.]github[.]io/msc/cl[.]png | Specific GitHub Pages resource identified as a malicious PowerShell payload stage. |
MITRE ATT&CK
T1055.012 · Process HollowingThe CyberGate sample used a RunPE stub and hollowed a copy of itself; another assembly injected code into a process.T1059.001 · PowerShellA PowerShell script in the infection chain downloaded and ran subsequent payload stages.T1059.005 · Visual BasicA macro extracted embedded data and a VBScript stage was executed through mshta.T1105 · Ingress Tool TransferThe scripts downloaded additional HTML, PowerShell, and malware payload stages.T1218.005 · MshtaThe macro invoked mshta to run an HTML document containing VBScript.T1562.001 · Disable or Modify ToolsA .NET assembly patched AMSI to prevent malware detection.T1573.002 · Asymmetric CryptographyAsyncRAT C2 communications with the reported server used TLS encryption.
People
Threat Actors
AkconsultThe researchers associate this handle with the threat actor and identify it as a CyberGate operator identification.bodmasUsername the researchers say the actor used; also associated with a domain contacted by samples using Aspire and CyberGate.kimjoyUsername the researchers say the actor used; also associated with the aviation campaigns and kimjoy[.]ddns[.]net.Nassief2018Forum handle linked by the researchers to the actor's early campaigns; the account reportedly also used the usernames bodmas and kimjoy.
Malware
AsyncRATIn this post, we will show how our research uncovered information about the attackers spreading AsyncRAT and njRAT using specific lure documents centered around the aviation industry. If infected with these threats,CyberGateThe sample identified was first seen on Feb. 7, 2013 and was packed with a .NET packer that performs a triple reflection of the RunPE stub, before hollowing a copy of itself to inject the CyberGate malware.H-Wormv. Mutairi et al." In this case, Microsoft made a complaint against the creators of njWorm and the H-worm and VitalWerks, along with the owner of the domain zapto.org. A deeper look into the case indicates thatnjRATthis post, we will show how our research uncovered information about the attackers spreading AsyncRAT and njRAT using specific lure documents centered around the aviation industry. If infected with these threats,njWormCorporation v. Mutairi et al." In this case, Microsoft made a complaint against the creators of njWorm and the H-worm and VitalWerks, along with the owner of the domain zapto.org. A deeper look into the case
Vendors
CiscoCisco Talos linked the recent aviation targeting campaigns to an actor who has been targeting the aviation industry for two years.MicrosoftWe started our research into these campaigns after a tweet from Microsoft describing new attacks they discovered using AsyncRAT. Our researchers looked at the domain Microsoft Security Intelligence mentioned,
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco DuoCisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Network/Cloud AnalyticsCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.Firewall Management CenterAdditional protections with context to your specific environment and threat data are available from the Firewall Management Center.Google DriveThese emails would appear to contain an attached PDF file that was a link to a .vbs file hosted on Google Drive.Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Microsoft PublisherConvoluted njRAT When we started the analysis on the Microsoft Publisher files and, given the previous TTPs from this actor, we were not expecting the number of layers in the infection chain.Orbital Advanced SearchCisco Secure Endpoint users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat. For specific OSqueries, click here.Snort Subscriber Rule SetOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. The following SIDs have been released to detect this threat: 58083-58088.StealthwatchCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Stealthwatch CloudCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Threat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Threat GridCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.UmbrellaUmbrella, Cisco's secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
Aspire crypterHostname bodmas[.]linkpc[.]net We discovered this domain because "bodmas" is one of the usernames the threat actors use for the Aspire crypter.mshtaThis macro downloads an HTML document from the C2 and uses the mshta, as can be seen on the image above on the right.PowerShellThis code contains a PowerShell script which, after deobfuscation, looks like the image below.
Countries
Dominican Republicthis domain as a C2. The table below shows the submissions done with the same IP address from the Dominican Republic, a single time, indicating that tests were being performed.NigeriaWe believe the actor is based out of Nigeria with a high degree of confidence and doesn't seem to be technically sophisticated, using off-the-shelf malware since the beginning of its activities without developing its