Campo Loader Delivers Additional Malware to Japanese Victims

Yet another cybercrime campaign is targeting users and organizations in Japan. Experts suspect that the malicious attacks have been taking place since October 2020, but they were only identified and analyzed around March 2021. The criminals behind these attack are using a new malicious implant tracked under the alias Campo Loader. This threat is designed to bypass basic network security rules and services and then deploy a secondary payload on the compromised network.

The initial infection vector that the criminals rely on is not a surprise – they use phishing emails written in Japanese. Typically, the recipient is asked to download and review an attachment. The attackers have made an effort to password-protect the attached archives, therefore leaving users under the impression that the attachment does contain important information. Once the malicious file is downloaded and launched, the Campo Loader will be planted in a hidden directory. It will also grant itself persistence by modifying the Windows Registry without the user's approval.

So far, the attackers have been using a wide range of secondary payloads, which serve different purposes. Their plans appear to be rather chaotic, judging by the types of malware they use – TrickBot Trojan, Phobos Ransomware, Ursnif, and Cobalt Strike. The criminals also use a complicated set of servers to command active implants. Surprisingly, some of the servers are situated in Japan, but the larger part of them is spread around the world.

So, how does one protect themselves from the Campo Loader and similar malware? Users should never interact with unknown emails, especially if they insist on convincing them to download and launch a file attachment. Malicious email attachments are the most widely used method to spread malware, so you should always approach unexpected emails with caution. Furthermore, it is recommended to keep your network secured by 3rd-party antivirus and firewall software, which can prevent threats like the Campo Loader from running at all. Another recent attack in the region involved the SmsSpy Android Malware.