Lone Wolf 🐺 Targets India & Afghan

A new malware campaign targeting Afghanistan and India is exploiting a now-patched, 20-year-old flaw affecting Microsoft Office to deploy an array of commodity RATs that allow the adversary to gain complete control over the compromised endpoints.

The campaign attributes to a “lone wolf” threat actor operating a pakistan based fake IT company called Bunse Technologies as a front to carry out the malicious activities, while also having a history of sharing content that’s in favor of Pakistan and Taliban dating all the way back to 2016.

The attacks work by using lure domains political and government themes that host the malware payloads. The laced RTF files were found exploiting CVE-2017-11882 to execute a PowerShell command that’s responsible for deploying additional malware to conduct reconnaissance on the machine.

CVE-2017-11882 concerns a memory corruption vulnerability that could be abused to run arbitrary code The flaw, which is believed to have existed since 2000, eventually Patched during 2017.

The recon phase is followed by a similar attack chain that includes installation of commodity malware such as DcRAT, and QuasarRAT that come with a variety of functionalities right out of the box including remote shells, process management, file management, keylogging, and credential theft, thus requiring minimal efforts on part of the attacker.

Also observed during the cybercrime operation was a browser credential stealer for Brave, Microsoft Edge, Mozilla Firefox, Google Chrome, Opera, Opera GX, and Yandex Browser.

This campaign is a classic example of an individual threat actor employing political, humanitarian and diplomatic themes in a campaign to deliver commodity malware to victims.Commodity RAT families are increasingly being used by both crimeware and APT groups to infect their targets. These families also act as excellent launch pads for deploying additional malware against their victims.