Remcos RAT Spyware Scurries Into Machines via Cloud Servers

Attackers use phishing emails that appear to come from reputable organizations, dropping the payload using public cloud servers and an old Windows UAC bypass technique.

A
phishing campaign
targeting organizations in Eastern Europe is leveraging an old Windows User Account Control (UAC) bypass technique to drop the
Remcos remote access Trojan (RAT)
, to perform cyber espionage across the region, researchers have found.
The campaign uses emails that appear to come from legitimate and highly regarded institutions in the targeted country to lure victims, researchers from SentinelOne revealed in a recent
blog post
. If successful in getting users to click on a malicious link, attackers leverage the DBatLoader malware loader, which abuses a technique identified more than two years ago to set up mock trusted folders to bypass Windows UAC and drop the RAT, the researchers said.
DBatLoader is known for using public cloud infrastructure to host its malware staging component, the SentinelOne researchers said. In the case of this campaign, they have observed download links to Microsoft OneDrive and Google Drive sites that have been used for this purpose, one of which was active for more than a month, they said.
When a user decompresses the attachment and runs the executable within, DBatLoader downloads and executes an obfuscated second-stage payload data from a public cloud location, SentinelOne senior threat researcher Aleksandar Milenkoski wrote in the post.
The executable in this case is the Remcos RAT, a malware that threat actors with cybercriminal and espionage motivations widely use to take over computers and collect keystrokes, audio, video, screenshots, and system information as well as deliver other malware, the researchers noted.
Indeed, the campaign observed by SentinelOne is likely linked to reports by the
Ukrainian CERT
of phishing campaigns targeting Ukrainian state institutions for espionage purposes using password-protected archives as email attachments, which also deliver the RAT, Milenkoski wrote.
Rather than use socially engineered messages in the campaign, attackers rely solely on the reputations of the purported organizations from which the messages are sent to trick victims into taking the bait, the SentinelOne researchers said.
In fact, the messages generally contain no text at all but merely the malicious attachment, they said. In the cases that the messages do include text, its written in the language of the target’s country, the researchers added. Further, attackers typically send the emails to the sales departments of the targets or publicly available contact email addresses for the organizations. The emails include attachments in the form of tar.lzarchives that typically masquerade as financial documents, such as invoices or tender documentation that appear to originate from institutions or business organizations related to the target. Some attachments purport to be Microsoft Office, LibreOffice, or PDF documents and use double extensions and/or application icons to fool victims.
Many of the phishing emails we observed have been sent from email accounts with top-level domains of the same country as where the target is based, Milenkoski wrote.
We observed emails sent from what seems to be compromised private email accounts and accounts from public email services that are also used by the targets and the legitimate institutions or organizations, which are supposedly sending the email, Milenkoski added.
When a user decompresses the attachment and runs the executable within, DBatLoader downloads and executes an obfuscated second-stage payload data from an aforementioned public cloud location, which then creates and executes an initial Windows batch script in the %Public%Libraries directory, the researchers said.
This script abuses a previously identified method for bypassing Windows UAC that involves the creation of mock trusted directories, such as %SystemRoot%System32; this allows attackers to conduct activities with elevated privileges without alerting users, the researchers said. Security researcher Daniel Gebert
discovered and subsequently revealed
the UAC bypass in a July 2020 post on his security blog.
The bypass occurs through a combination of the mock trusted directories and DLL hijacking, which together cause Windows to automatically elevate the process without issuing an UAC prompt, Milenkoski wrote.
The resulting bypass allows DBatLoader to establish persistence across system reboots, by copying itself in the %Public%Libraries directory and creating an autorun registry key that points to an Internet Shortcut file, he explained in the post. This executes the DBatLoader executable in the mock directory, which in turn executes the Remcos RAT through process injection.
Researchers observed a wide variety of Remcos RAT configurations on victim systems, most of which were configured for keylogging and screenshot-theft capabilities, as well as duckdns dynamic DNS domains for command-and-control purposes, Milenkoski wrote.
Researchers made a number of recommendations to security administrators to dodge the campaign, particularly given its use of DBatLoader coming through on the public cloud.
First and foremost, they advised vigilance against malicious network requests to public cloud instances, noting that attackers use of public cloud infrastructure for hosting malware is an attempt to make network traffic for malware delivery look legitimate and thus harder for organizations to detect. This tactic is popular amongst cybercriminals and espionage threat actors, Milenkoski observed.
Researchers also recommended that administrators monitor for suspicious file creation activities in the %Public%Library directory, and process-execution activities that involve filesystem paths with trailing spaces, especially Windows . The latter is a reliable indicator of malware attempting to bypass Windows UAC by abusing mock trusted directories, such as %SystemRoot%System32, Milenkoski wrote.
Another tactic for avoiding compromise that administrators should consider is configuring Windows UAC to always notify, which will always alert users when a program attempts to make changes to computers across a business network, he added.
Researchers also enforced general advice for avoiding
phishing
compromise in any form by ensuring that administrators and employees alike are aware of what malicious emails look like and how to avoid engaging with them.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Remcos RAT Spyware Scurries Into Machines via Cloud Servers