New PEAPOD Cyberattack Campaign Targeting Women Political Leaders

European Union armed service personnel and political leaders operating on gender equality initiatives have emerged as the target of a new marketing campaign that delivers an current variation of RomCom RAT named PEAPOD.

Cybersecurity firm Pattern Micro attributed the attacks to a danger actor it tracks under the title Void Rabisu, which is also known as Storm-0978, Tropical Scorpius, and UNC2596, and is also believed to be related with Cuba ransomware.

The adversarial collective is a little something of an abnormal team in that it conducts each economical inspired and espionage attacks, blurring the line amongst their modes of procedure. It truly is also exclusively joined to the use of RomCom RAT.

Assaults involving the use of the backdoor have singled out Ukraine and international locations that support Ukraine in its war against Russia over the previous calendar year.

Previously this July, Microsoft implicated Void Rabisu to the exploitation of CVE-2023-36884, a remote code execution flaw in Office and Windows HTML, by utilizing specifically-crafted Microsoft Office doc lures linked to the Ukrainian Environment Congress.

RomCom RAT is able of interacting with a command-and-command (C&C) server to obtain commands and execute them on the victim’s device, although also packing in protection evasion strategies, marking a regular evolution in its sophistication.

The malware is ordinarily dispersed by using highly specific spear-phishing email messages and bogus advertisements on search engines like Google and Bing to trick customers into traveling to entice sites hosting trojanized versions of reputable apps.

“Void Rabisu is one particular of the clearest illustrations where by we see a blend of the normal methods, procedures, and techniques (TTPs) made use of by cybercriminal danger actors and TTPs applied by nation-condition-sponsored risk actors determined mostly by espionage ambitions,” Development Micro reported.

The hottest established of assaults detected by the organization in August 2023 also supply RomCom RAT, only it can be an up-to-date and slimmed-down iteration of the malware that’s distributed by way of a web site named wplsummit[.]com, which is a duplicate of the legit wplsummit[.]org domain.

Existing on the web-site is a url to a Microsoft OneDrive folder that hosts an executable named “Unpublished Photographs 1-20230802T122531-002-sfx.exe,” a 21.6 MB file that aims to mimic a folder containing pics from the Gals Political Leaders (WPL) Summit that took position in June 2023.

The binary is a downloader that drops 56 photographs on to the concentrate on method as a decoy, whilst retrieving a DLL file from a remote server. These shots are mentioned to have been sourced by the malicious actor from personal posts on numerous social media platforms these as LinkedIn, X (previously known as Twitter), and Instagram.

The DLL file, for its component, establishes get in touch with with a different domain to fetch the third-stage PEAPOD artifact, which supports 10 commands in complete, down from 42 instructions supported by its predecessor.

The revised version is outfitted to execute arbitrary instructions, down load and upload information, get method information, and even uninstall by itself from the compromised host. By stripping down the malware to the most important capabilities, the notion is to limit its digital footprint and complicate detection endeavours.

“When we have no proof that Void Rabisu is nation-state-sponsored, it really is feasible that it is a person of the fiscally determined risk actors from the felony underground that acquired pulled into cyberespionage actions because of to the extraordinary geopolitical conditions brought on by the war in Ukraine,” Craze Micro mentioned.

Located this posting appealing? Comply with us on Twitter  and LinkedIn to examine additional special content we article.

Some parts of this article are sourced from:
thehackernews.com