Spectralviper Malware Targets Vietnamese Corporations

Vietnamese public corporations have become the focus of an ongoing initiative that employs an innovative covert method known as SPECTRALVIPER.

Elastic Security Labs, in a recent report, described SPECTRALVIPER as a highly obscured backdoor, previously undisclosed, specifically designed for x64 systems. It possesses various functionalities, including PE loading and injection, file upload and download, file and directory manipulation, and token impersonation capabilities.

The attacks have been linked to an actor known as REF2754, which shares similarities with a Vietnamese threat group referred to as APT32, Canvas Cyclone (previously Bismuth), Cobalt Kitty, and OceanLotus.

Meta previously associated the activities of this hacking group with a cybersecurity company named CyberOne Group in December 2020.

Spectralviper Mode of Operation

In the latest attack uncovered by Elastic, the SysInternals ProcDump utility is utilized to load an unsigned DLL file containing DONUTLOADER. DONUTLOADER is then configured to load SPECTRALVIPER along with other malware like P8LOADER or POWERSEAL.

SPECTRALVIPER is programmed to communicate with a server controlled by the actor, awaiting further instructions. It employs obfuscation techniques such as control flow flattening to hinder analysis.

P8LOADER, written in C++, has the ability to execute arbitrary payloads from a file or memory. Additionally, a custom-built PowerShell runner named POWERSEAL is utilized to run supplied PowerShell scripts or commands.

REF2754 shares tactical similarities with another group known as REF4322, which primarily targets Vietnamese organizations to deploy a post-exploitation implant called PHOREAL (also known as Rizzo).

These connections have led to speculation that both the REF4322 and REF2754 groups are engaged in campaigns planned and executed by a Vietnamese state-affiliated threat.

Meanwhile, a separate malware known as SOMNIRECORD has been associated with the intrusion set REF2924. SOMNIRECORD employs DNS queries to establish communication with a remote server and evade network security controls.

Similar to NAPLISTENER, SOMNIRECORD leverages existing open source projects to enhance its capabilities. It can gather information about the infected system, list all running processes, deploy a web shell, and execute any pre-existing executable files present on the compromised machine.