Kimsuki hackers use commodity RATs with custom Gold Dragon malware

South Korean researchers have spotted a new wave of activity from the Kimsuky hacking group, involving commodity open-source remote access tools dropped with their custom backdoor, Gold Dragon.

Kimsuky is a North Korean state-sponsored hacking group, also known as TA406, who has been actively involved in cyber-espionage campaigns since 2017.

The group has demonstrated impressive operational versatility and threat activity pluralism, engaging in malware distribution, phishing, data collection, and even cryptocurrency theft.

In the latest campaign, spotted by analysts at ASEC (AhnLab), Kimsuky uses xRAT in targeted attacks against South Korean entities. The campaign started on January 24, 2022, and is still ongoing.

Commodity RAT

xRAT is an open-source remote access and administration tool available for free on GitHub. The malware provides a range of features such as keylogging, remote shell, file manager actions, reverse HTTPS proxy, AES-128 communication, and automated social engineering.

A sophisticated threat actor may choose to use commodity RATs because, for basic reconnaissance operations, these tools are perfectly adequate and don’t require much configuration.

This allows threat actors to focus their resources on developing later-stage malware that requires more specialized functionality depending on the defense tools/practices present on the target.

Also, commodity RATs blend in with activity from a broad spectrum of threat actors, making it harder for analysts to attribute malicious activity to a particular group.

Gold Dragon backdoor

Gold Dragon is a second-stage backdoor that Kimsuky typically deploys after a file-less PowerShell-based first-stage attack that leverages steganography.

It has been documented in a 2020 report by Cybereason and a 2021 analysis by researchers at Cisco Talos, so this is not a novel malware.

However, as ASEC explains in its report, the variant they spotted in this latest campaign features additional functions such as the exfiltration of basic system information.

The malware no longer uses system processes for this function but instead installs the xRAT tool to steal the needed information manually.

The RAT comes under the disguise of an executable named cp1093.exe, which copies a normal PowerShell process (powershell_ise.exe) to the “C:\ProgramData\”path and executes via process hollowing.

On the operational aspects of Gold Dragon, it continues to use the same process hollowing method on iexplore.exe and svchost.exe, and still attempts to disable real-time detection features in AhnLab AV products.

“The attacker installed Gold Dragon through the exclusive installer (installer_sk5621.com.co.exe). The installer downloads Gold Dragon compressed in the form of a Gzip file from the attacker’s server, decompresses it as “in[random 4 numbers].tmp” in the %temp% path, then executes it via rundll32.exe.” – ASEC.

Next, the installer adds a new registry key to establish startup persistence for the malware payload (glu32.dll).

Finally, Kimsuky drops an uninstaller (UnInstall_kr5829.co.in.exe) that can delete the traces of compromise if and when needed.

AhnLab suggests that users should refrain from opening attachments on emails from unknown sources, as this remains the main channel of malware distribution for Kimsuky.

Source: https://www.bleepingcomputer.com/news/security/kimsuki-hackers-use-commodity-rats-with-custom-gold-dragon-malware/