Weekly Cyber Round-up

OceanLotus uses malicious Cobalt Strike plugin to target Chinese cybersecurity personnel

ThreatBook researchers linked the recent reports of a backdoored Cobalt Strike exploit plugin to the Southeast Asian advanced persistent threat actor, OceanLotus. The malicious version was published on GitHub in October 2024 to target Chinese cybersecurity professionals. The researchers also identified similar samples used in attacks since mid-September 2024. The attackers embedded a malicious SUO file into a Visual Studio project to evade detection. Upon compiling the Visual Studio project, the trojan automatically executes, after which it is overwritten and deleted, to further evade detection. The DLL hollowing technique, commonly used by OceanLotus, is used to deliver the malware, while the note-taking platform Notion is used for C2 communication.

RedCurl uses new RedLoader backdoor to target organisations in Canada

Huntress researchers observed a campaign, attributed to the advanced persistent threat actor RedCurl, targeting organisations in Canada from at least November 2023 to late 2024 as part of its espionage efforts. The campaign saw the deployment of a new malware, dubbed RedLoader, that has basic backdoor capabilities. RedLoader uses dynamic DLL resolution, string encryption, and junk C2 addresses for obfuscation. Some changes in its techniques and infection chain were observed compared to previous reported cases. This includes the use of living-off-the-land binaries like Pcalua in scheduled tasks for malware and script execution, data exfiltration with 7zip, and utilizing the RPivot tool to set up reverse proxy tunnels via Python scripts. RedCurl was also observed using many different batch files, alongside PowerShell and Python script to execute its attacks.

Double-Tap campaign targeting Kazakhstan linked to UAC-0063

Sekoia researchers identified multiple legitimate Office documents from the Ministry of Foreign Affairs being used as part of an ongoing UAC-0063 cyberespionage campaign. The campaign targets Central Asia, including Kazakhstan and its diplomatic and economic relations with Asian and Western countries. It involves a new infection chain, dubbed Double-Tap, to deliver HATVIBE and CHERRYSPY malware. The infection chain involves previously unknown malicious code within the delivered documents, with a malicious macro aimed at creating another malicious document. The second document is automatically opened in a hidden Word instance and drops and executes a malicious HTA file with HATVIBE embedded. The observed infection chain shares similarities with previous Zebrocy infection chains, including the use of VBA scripts to drop a backdoor. The researchers asses with medium confidence that UAC-0063 is related to the Russian threat actor, APT28.

Fraudsters target Middle East with real estate scams

Group-IB researchers observed an increase in real estate scams in the Middle East exploiting online platforms to deceive victims into paying for fake properties. The scammers typically target specific groups such as expatriates or individuals relocating to new cities. The scheme begins with the fraudster finding a suitable advertisement on a platform, copying it, and publishing it under their name. Victims who view the ad contact the scammer via the platform’s messenger or via a third-party application, most commonly WhatsApp, where the scammer provides the victim with proof of their reliability, including a fake property agreement and a fake rental contract. The fraudster then receives the victim’s funds either via an electric wallet linked to their account on the rental registration platform, or through a direct transfer to a mule account.