Konni Group Using Russian-Language Malicious Word Docs in Latest Attacks

A new phishing attack has been observed leveraging a Russian-language Microsoft Term doc to supply malware able of harvesting sensitive facts from compromised Windows hosts.

The action has been attributed to a threat actor identified as Konni, which is assessed to share overlaps with a North Korean cluster tracked as Kimsuky (aka APT43).

“This marketing campaign relies on a distant accessibility trojan (RAT) able of extracting data and executing instructions on compromised devices,” Fortinet FortiGuard Labs researcher Cara Lin mentioned in an evaluation printed this 7 days.

The cyber espionage group is notable for its focusing on of Russia, with the modus operandi involving the use of spear-phishing e-mail and malicious paperwork as entry factors for their attacks.

Recent attacks documented by Knowsec and ThreatMon have leveraged the WinRAR vulnerability (CVE-2023-38831) as effectively as obfuscated Visual Essential scripts to fall Konni RAT and a Windows Batch script able of collecting info from the contaminated equipment.

“Konni’s key objectives include things like info exfiltration and conducting espionage functions,” ThreatMon reported. “To achieve these targets, the group employs a wide array of malware and instruments, commonly adapting their practices to steer clear of detection and attribution.”

The most up-to-date attack sequence observed by Fortinet entails a macro-laced Term doc that, when enabled, displays an short article in Russian which is purportedly about “Western Assessments of the Progress of the Unique Army Operation.”

The Visual Primary for Application (VBA) macro subsequently proceeds to launch an interim Batch script that performs method checks, Consumer Account Management (UAC) bypass, and finally paves the way for the deployment of a DLL file that incorporates data collecting and exfiltration abilities.

“The payload incorporates a UAC bypass and encrypted interaction with a C2 server, enabling the risk actor to execute privileged commands,” Lin claimed.

Konni is significantly from the only North Korean threat actor to one out Russia. Proof collected by Kaspersky, Microsoft, and SentinelOne reveals that the adversarial collective referred to as ScarCruft (aka APT37) has also focused investing corporations and missile engineering companies situated in the country.

The disclosure also arrives a lot less than two months right after Solar, the cybersecurity arm of Russian point out-owned telecom business Rostelecom, unveiled that risk actors from Asia – mostly all those from China and North Korea – accounted for a bulk of assaults towards the country’s infrastructure.

“The North Korean Lazarus team is also extremely active on the territory of the Russian Federation,” the corporation said. “As of early November, Lazarus hackers still have entry to a selection of Russian techniques.”

Observed this article exciting? Adhere to us on Twitter  and LinkedIn to read more special written content we put up.

Some parts of this article are sourced from:
thehackernews.com