Guyana Governmental Entity Hit by DinodasRAT in Cyber Espionage Attack

A governmental entity in Guyana has been qualified as element of a cyber espionage marketing campaign dubbed Operation Jacana.

The action, which was detected by ESET in February 2023, entailed a spear-phishing attack that led to the deployment of a hitherto undocumented implant composed in C++ called DinodasRAT.

The Slovak cybersecurity company reported it could backlink the intrusion to a recognized danger actor or team, but attributed with medium self esteem to a China-nexus adversary owing to the use of PlugX (aka Korplug), a remote entry trojan prevalent to Chinese hacking crews.

“This campaign was qualified, as the risk actors crafted their e-mails particularly to entice their selected target business,” ESET mentioned in a report shared with The Hacker News.

“Soon after efficiently compromising an original but restricted established of devices with DinodasRAT, the operators proceeded to shift inside of and breach the target’s inner network, in which they again deployed this backdoor.”

The infection sequence commenced with a phishing email made up of a booby-trapped website link with issue traces referencing an alleged news report about a Guyanese fugitive in Vietnam.

Ought to a recipient simply click on the website link, a ZIP archive file is downloaded from the area fta.moit.gov[.]vn, indicating a compromise of a Vietnamese governmental web-site to host the payload.

Embedded inside of the ZIP archive is an executable that launches the DinodasRAT malware to acquire sensitive data from a victim’s personal computer.

DinodasRAT, moreover encrypting the information it sends to the command-and-command (C2) server working with the Tiny Encryption Algorithm (TEA), will come with capabilities to exfiltrate technique metadata, documents, manipulate Windows registry keys, and execute instructions.

Also deployed are tools for lateral motion, Korplug, and the SoftEther VPN consumer, the latter of which has been place to use by a different China-affiliated cluster tracked by Microsoft as Flax Hurricane.

“The attackers utilised a mixture of earlier unknown applications, these types of as DinodasRAT, and far more classic backdoors this kind of as Korplug,” ESET researcher Fernando Tavella explained.

“Dependent on the spear-phishing emails employed to gain original accessibility to the victim’s network, the operators are keeping track of the geopolitical routines of their victims to maximize the chance of their operation’s results.”

Identified this write-up fascinating? Adhere to us on Twitter  and LinkedIn to examine much more unique written content we post.

Some pieces of this posting are sourced from:
thehackernews.com