Agent Racoon Backdoor Targets Organizations in Middle East, Africa, and U.S.

Businesses in the Center East, Africa, and the U.S. have been qualified by an unknown menace actor to distribute a new backdoor called Agent Racoon.

“This malware family members is penned employing the .NET framework and leverages the area title services (DNS) protocol to create a covert channel and offer diverse backdoor functionalities,” Palo Alto Networks Unit 42 researcher Chema Garcia mentioned in a Friday investigation.

Targets of the assaults span a variety of sectors this sort of as schooling, true estate, retail, non-gains, telecom, and governments. The activity has not been attributed to a known risk actor, despite the fact that it truly is assessed to be a country-point out aligned owing to the victimology sample and the detection and defense evasion tactics applied.

The cybersecurity agency is monitoring the cluster beneath the moniker CL-STA-0002. It truly is presently not obvious how these corporations were breached, and when the assaults took place.

Some of the other instruments deployed by the adversary contain a custom made version of Mimikatz named Mimilite as perfectly as a new utility identified as Ntospy, which utilizes a tailor made DLL module implementing a network supplier to steal qualifications to a distant server.

“While the attackers normally utilized Ntospy throughout the affected organizations, the Mimilite tool and the Agent Racoon malware have only been observed in nonprofit and government-related organizations’ environments,” Garcia defined.

It is truly worth pointing out a beforehand determined danger activity cluster known as CL-STA-0043 has also been linked to the use of Ntospy, with the adversary also concentrating on two businesses that have been targeted by CL-STA-0002.

Agent Raccoon, executed by means of scheduled duties, makes it possible for for command execution, file uploading, and file downloading, whilst disguising by itself as Google Update and Microsoft OneDrive Updater binaries.

The command-and-management (C2) infrastructure employed in connection with the implant dates back again to at the very least August 2020. An assessment of VirusTotal submissions of the Agent Racoon artifacts exhibits that the earliest sample was uploaded in July 2022.

Unit 42 claimed it also uncovered evidence of effective info exfiltration from Microsoft Exchange Server environments, resulting in the theft of e-mails matching unique look for standards. The danger actor has also been located to harvest victims’ Roaming Profile.

“This instrument set is not still related with a unique menace actor, and not completely restricted to a solitary cluster or campaign,” Garcia explained.

Found this short article fascinating? Comply with us on Twitter  and LinkedIn to browse additional unique written content we publish.

Some parts of this article are sourced from:
thehackernews.com