M2RAT Malware Hides in Doctored Images with Malicious Payload

The RedEyes Hacking Group, also known as APT37, is a threat group that has been engaging in cyber espionage activities. Recently, they have adopted a new tactic to collect intelligence from targeted individuals by using a sophisticated malware called M2RAT. This malware is designed to evade detection by security software and the group has also been utilizing steganography, which hides information within seemingly innocuous files or images. It is believed that North Korea supports this hacking group and it operates in cyberespionage.

In 2022, the notorious hacking group was observed taking advantage of zero-day vulnerabilities in Internet Explorer through social engineering tactics. They enticed their targets into opening emails with malicious attachments that exploited an old EPS vulnerability identified as CVE-2017-8291. This vulnerability was present in the Hangul word processor commonly used in South Korea and allowed attackers to run shellcode on victim’s computers when they opened a JPEG image tampered with by the attacker. Once triggered, it caused victims’ computers to download and execute a malicious payload stored within the JPEG image.

The group of threat actors then turned their attention to various entities based in Europe deploying a new variant of their mobile backdoor called "Dolphin" and a customized remote access trojan (RAT) called "Konni."

What is steganography - the technique used in distributing M2RAT?

Steganography is a technique used to conceal information within seemingly normal and harmless images. It is used by the APT37 hacking group to further hide their activities when distributing M2RAT malware.

What is a remote access trojan?

A remote access trojan (RAT) is a type of malicious software that allows an attacker to gain control over a victim's computer. The attacker can then use the RAT to access files, steal data, and even take control of the system. RATs are often used in targeted attacks, such as those conducted by APT37, where they are used to gain access to sensitive information or systems. RATs can be spread through phishing emails or other malicious links, and once installed on a system they can be difficult to detect and remove. RATs are also capable of monitoring user activity and collecting data from victims without their knowledge. As such, it is important for users to remain vigilant when it comes to cyber security and ensure that their systems are protected against these types of threats.