KamiKakaBot Targets Asian Government Bodies
During February 2023, a series of malwares known as KamiKakaBot were discovered by researchers at EclecticIQ.
These malware instances were found to have targeted government institutions in ASEAN countries. It was observed that the attacks that took place in February were similar to those reported by Group-IB in January 2023, where the threat actors used ISO images to deliver KamiKakaBot through DLL side-loading technique. However, in the February campaign, the obfuscation routine was improved to better evade anti-malware measures. By identifying multiple overlaps, EclecticIQ analysts were able to attribute the attacks to the Dark Pink APT group, which is active in the ASEAN region.
The Dark Pink group is believed to have started operations in mid-2021 and has been increasing its activity in 2022. The primary function of KamiKakaBot is to steal data stored in web browsers, such as saved credentials, browsing history, and cookies. The developers of KamiKakaBot use various techniques to remain undetected while executing malicious actions on infected devices, such as Living-off-the-Land binaries (LOLBINs) like MsBuild.exe.
Distribution Methods for KamiKaka and Mode of Operation
Phishing emails are used to distribute KamiKakaBot, which comes in the form of a malicious ISO file attachment. This file contains a legitimate Microsoft-signed WinWord.exe, which is exploited for DLL side-loading technique. When the user clicks on WinWord.exe, the KamiKakaBot loader (MSVCR100.dll) located in the same folder as WinWord is automatically loaded into memory and executed.
The malicious ISO file also contains a decoy Word document with an encrypted section that is XOR-encoded. The KamiKakaBot loader utilizes this section to decrypt the XOR-encoded content from the decoy file and then writes the decrypted XML payload of KamiKakaBot to disk (C:\Windows\temp) and executes it via a living-off-the-land binary, MsBuild.exe.
KamiKakaBot is capable of extracting sensitive information from Chrome, MS Edge, and Firefox web browsers, and the stolen data is compressed into a ZIP format and sent to the attackers' Telegram bot channel. After the initial infection, the attacker can upgrade the malware or execute remote code on the targeted device, allowing for further post-exploitation activities. All communication between the malware and the command-and-control center is carried out via a Telegram bot that is controlled by the threat actor.
