Bitter APT Hackers Continue to Target Bangladesh Military Entities

Navy entities situated in Bangladesh continue to be at the getting conclusion of sustained cyberattacks by an highly developed persistent risk tracked as Bitter.

“By way of malicious document data files and intermediate malware stages the danger actors perform espionage by deploying Remote Access Trojans,” cybersecurity agency SECUINFRA claimed in a new create-up published on July 5.

The findings from the Berlin-headquartered organization establish on a past report from Cisco Talos in Might, which disclosed the group’s enlargement in concentrating on to strike Bangladeshi federal government organizations with a backdoor known as ZxxZ.

Bitter, also tracked beneath the codenames APT-C-08 and T-APT-17, is stated to be lively considering that at the very least late 2013 and has a track document of focusing on China, Pakistan, and Saudi Arabia applying unique applications this sort of as BitterRAT and ArtraDownloader.

The most recent attack chain specific by SECUINFRA is thought to have been performed in mid-May possibly 2022, originating with a weaponized Excel doc probable distributed by implies of a spear-phishing email that, when opened, exploits the Microsoft Equation Editor exploit (CVE-2018-0798) to fall the subsequent-stage binary from a remote server.

ZxxZ (or MuuyDownloader by the Qi-Anxin Risk Intelligence Center), as the downloaded payload is termed, is carried out in Visual C++ and features as a second-phase implant that will allow the adversary to deploy supplemental malware.

The most notable change in the malware is that it has dropped employing “ZxxZ” as the separator made use of when sending information again to the command-and-control (C2) server in favor of an underscore, suggesting that the group is actively creating modifications to its supply code to remain less than the radar.

Also put to use by the menace actor in its campaigns is a backdoor dubbed Almond RAT, a .NET-based mostly RAT that to start with arrived to light in May 2022 and provides simple facts accumulating features and the capacity to execute arbitrary instructions. In addition, the implant employs obfuscation and string encryption strategies to evade detection and to hinder investigation.

“Almond RATs main applications appear to be to be file method discovery, facts exfiltration and a way to load much more resources/set up persistence,” the scientists said. “The layout of the applications seems to be laid out in a way that it can be quickly modified and adapted to the present-day attack situation.”

Uncovered this write-up attention-grabbing? Adhere to THN on Fb, Twitter  and LinkedIn to browse far more exclusive material we post.

Some parts of this write-up are sourced from:
thehackernews.com