Kaspersky BlindEagle AUG 2024

APT-C-36 used a customized version of QuasarRAT to monitor browser windows for strings relating to specific Colombian financial institutions.

njRAT has a module for performing remote desktop access.

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection. APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.

APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.

APT-C-36 has used encoded and obfuscated files, images, and executables.

APT-C-36 has disguised malicious executables to appear as legitimate files.

njRAT has used C2 infrastructure to receive stolen information from the infected machine including screenshots and other system information.

APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes.

njRAT is capable of logging keystrokes.

QuasarRAT has a built-in keylogger.

APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.

njRAT can download files to the victim’s machine. APT-C-36 has used modified versions of njRAT to enable the download of .NET assemblies.

njRAT can capture screenshots of the victim’s machines.

APT-C-36 has used malicious links in emails, often impersonating official notifications and documents, to direct users to execute malicious payloads.

APT-C-36 has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.

QuasarRAT can obtain passwords from common web browsers.

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

APT-C-36 has used side-loading to execute the HijackLoader payload.

APT-C-36 has acquired domains to host malicious payloads.

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.

APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.

APT-C-36 has staged malware implants on group-owned repositories and sites.

APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.