Weekly Cyber Round-up

Space Pirates targets Russian IT firms with LuckyStrike Agent for espionage and credential theft

Solar researchers detailed an espionage campaign, attributed to the threat actor Space Pirates, targeting Russian IT organisations. The campaign delivers a new multi-functional .NET backdoor, dubbed LuckyStrike Agent, which uses Microsoft OneDrive for C2 purposes. Other tools leveraged as part of the campaign include Deed RAT and a modified version of Stowaway. LuckyStrike Agent was first identified in November 2024, though initial access to the targeted organisation occurred before March 2023. Throughout this time, Space Pirates slowly spread across the victim’s systems and modified their tools, possibly to remove existing detection signatures. For example, the modified Stowaway variant retains only its proxy functionality alongside using LZ4 as a compression algorithm and XXTEA as an encryption algorithm.

Dark Caracal uses PocoRAT to target Spanish-speaking victims in Latin America

Throughout 2024, Positive Technologies researchers observed a phishing campaign delivering a new remote access trojan (RAT), dubbed Poco RAT, to Spanish-speaking victims in Latin America. The campaign involves phishing emails containing a decoy PDF document disguised as financial notifications, often referencing unpaid invoices or tax documents. Once the PDF is opened, the file redirects the victim to a link that automatically downloads a REV archive, hosted either on Google Drive or Dropbox, or on a content delivery network directory named after the impersonated company. The REV archive contains a Poco RAT dropper that injects itself into a legitimate process. The campaign is believed to be an extension of a campaign by threat actor Dark Caracal that began in 2022 and delivered Bandook RAT.

Phishing campaign combines ClickFix and multi-stage malware to deploy Havoc Demon Agent

Fortinet researchers discovered a phishing campaign that combines ClickFix and multi-stage malware to deploy a modified version of Havoc Demon. The threat actors hide each stage of the malware behind a SharePoint site, using the modified Havoc Demon alongside Microsoft Graph API to obscure C2 communications within well-known services. The initial infection vector is via a phishing email containing an attached HTML file, which is a ClickFix attack that deceives users into copying and pasting a PowerShell command into their terminal. A GitHub shellcode loader KaynLdr is then used to execute the Havoc Demon DLL. Exploitation of the modified Havoc Demon allows threat actors to gather information about the target, file operations, execute commands and payloads, manipulate tokens, and conduct Kerberos attacks. 

BB2DOOR installed on low-cost consumer devices as part of BADBOX 2.0 fraud operation

HUMAN researchers discovered an expansive fraud operation, dubbed BADBOX 2.0, which infects low-cost consumer devices with a new backdoor, dubbed BB2DOOR. The backdoored devices become part of a botnet that can be used for programmatic ad fraud, click fraud, as well as residential proxy services that could enable account takeover attacks, fake account creation, distributed denial-of-service attacks, malware distribution, and one-time password theft. Over 1 million infected devices were identified, with BADBOX 2.0 deemed to be the largest botnet of infected connected TV (CTV) devices to date. BADBOX 2.0 is believed to be linked to the same actors behind BADBOX, with BB2DOOR similarly infecting devices as soon as they are turned on. BB2DOOR is also likely associated with the Vo1d malware. The researchers additionally identified four threat actor groups linked to BADBOX 2.0, namely SalesTracker Group, MoYu Group, Lemon Group, and LongTV.