A hacking group tracked as ‘UAC-0184’ was found using steganographic image files to deliver the Remcos remote access trojan (RAT) onto the systems of a Ukrainian entity operating in Finland.
In late 2023, Trend Micro found UAC-0184 threat actors carrying out attacks against the Armed Forces of Ukraine by using the same malware.
The threat group’s latest activity was spotted by Morphisec analysts; in which they have expanded to target organizations outside of Ukraine that are affiliated with their strategic target.
Morphisec did not provide technical information or specific details about the victim due to confidentiality but still shared some data on the employed attack methods.
Steganography is a well-documented but rarely seen tactic that involves encoding malicious code into the pixel data of images to evade detection by solutions using signature-based rules.
Typically, the small payload chunks in the image pixels do not result in an altered image appearance, but in the case seen by Morphisec, the image looks visibly distorted.
The attack chain observed by Morphisec starts with a carefully crafted phishing email supposedly from Ukraine’s 3rd Separate Assault Brigade or the Israel Defense Forces.
Tricked recipients opening the shortcut file attachment trigger an infection chain that launches an executable (DockerSystem_Gzv3.exe), which in turn activates a modular malware loader named ‘IDAT.’
IDAT employs unique features like code injection and execution modules, setting it apart from conventional loaders. It employs sophisticated techniques such as dynamic loading of Windows API functions, HTTP connectivity tests, process blocklists, and syscalls to evade detection.
To remain stealthy, API calls aren’t written in the code in plaintext form but are instead resolved at runtime using a decryption key that is part of the attack chain.
IDAT extracts the encoded payload that is embedded in the malicious PNG image file and then decrypts and executes it in memory, a process that involves multiple stages and additional modules that are injected into legitimate processes (Explorer.exe) and DLL files (PLA.dll).
The final stage involves the decryption and execution of the Remcos RAT, a commodity malware that hackers employ as a backdoor on compromised systems, allowing stealthy data theft and victim activity monitoring.
According to Morphisec, IDAT also delivers malware like Danabot, SystemBC, and RedLine Stealer, but it is unclear if these families were seen in the Finland-based computers or in different attacks.
Comments