A new malicious actor, known as TA886, has been identified by Proofpoint as targeting organizations in the United States and Germany with custom malware. The activity was first discovered in October 2022 and has continued into 2023. It is believed that the threat actor is motivated by financial gain, as they assess the value of the target before proceeding with further intrusion. The attack is initiated through phishing emails containing malicious attachments, such as Microsoft Publisher files with macros, URLs linking to Pub files with macros, or PDFs containing URLs that download dangerous JavaScript files. The emails are written in either English or German, depending on the target. If the recipient clicks on the URL, a multi-step attack chain is triggered, resulting in the download and execution of Screenshotter, a custom malware tool. This tool takes screenshots from the victim's machine and sends them back to the threat actor's server for review. The attackers then manually examine the screenshots to determine if the victim is of value. The stealer loaded in memory is called Rhadamanthys, a malware family that has been seen in underground forums since last summer and is becoming more commonly used in attacks. It is capable of stealing cryptocurrency wallets, credentials, and cookies stored in web browsers, FTP clients, Steam accounts, Telegram and Discord accounts, VPN configurations, and email clients. It can also steal files from the breached system. Proofpoint believes that TA886 is likely a Russian threat actor, based on the presence of Russian language variable names and comments in the code of the AHK Bot loader, as well as the fact that the threat actor is active during times that resemble a regular workday in the UTC+2 or UCT+3 time zone. They have attempted to find overlaps and similarities with past reports describing similar TTPs, but have not been able to make any definitive connections. TA886 attacks are still ongoing, and Proofpoint warns that Active Directory profiling should be a cause of concern, as it could compromise all domain-joined hosts with information-stealing malware.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 09 Feb 2023 17:39:02 +0000