Researchers Uncover Long-Term Cyber-Espionage Campaign
Security researchers have recently unveiled information about a long-term cyber-espionage campaign targeting fuel industry companies across the world. The campaign was focused on long-term detection avoidance and planting remote access trojans on the victim networks with the purpose of lasting data exfiltration and spying.
Researchers with security firm Intezer revealed that bad actors had been using narrowly targeted spear-phishing email campaigns that carry remote access trojan payloads as malicious attachments. The range of RAT malware used in the campaign varied greatly and includes infamous names such as Agent Tesla, Loki and AZORult. Those tools have the ability to both steal sensitive information and browser logins, but also to log keystrokes.
The campaign is almost entirely focused on oil and gas companies, but there are a few targeted outliers who are in the IT and media sectors. Curiously, the majority of the targeted companies are located in South Korea, with other targets located across the globe, including Europe and the US, as well as the United Arab Emirates.
Researchers also noted that one of the targets in the malicious campaign was markedly different from the rest. The odd one out is called FEBC and is a radio broadcasting entity located in South Korea, which according to the researchers at Intezer seeks to "subvert the religion ban" in the country's north neighbor.
The spear-phishing emails use spoofed sender fields and are made to look like they really originated from addresses and companies that would be well-known to the victims. Some of the emails used typosquatted domains - a domain that has a single character different from the legitimate one, for example a dot replaced with a dash or an "L" swapped with a 1.
The body of the malicious emails usually contains what looks like a legitimate business offer. The payloads are contained in fake PDF files that are really .cab archives or .iso images. Intezer also pointed out that the payload is deployed using fileless techniques, deploying directly into system memory without leaving any files on the hard drive that may trip up potential defenses.
Intezer also pointed out that the emails were especially well-done in terms of formatting and great care has been taken to make them look like legitimate business correspondence. There are many small details in the text of those emails that indicate the threat actor behind this is no amateur and has a very good grasp of what legitimate, high-profile business correspondence looks like.
