Loading malware…
AllaKore is a publicly available, Delphi-based remote access trojan. It has been used by the SideCopy threat group, including in campaigns targeting government personnel and other organizations in India and Pakistan. Transparent Tribe (APT36) has also used AllaKore among a broader arsenal of remote access trojans in South Asian espionage operations. Custom banking-malware variants in the AllaKore ecosystem, including AllaSenha and CarnavalHeist-related tooling, have targeted Brazilian financial institutions, but those variants have distinct functionality and should not be treated as equivalent to the base AllaKore RAT.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Помимо Crimson RAT, в арсенал APT36 входят DeskRAT, AresRAT, AllaKore, GetaRAT и Poseidon.
"...including CurlBack, SparkRAT, AresRAT, Xeno RAT, AllaKore, and ReverseRAT."
3 distinct techniques documented for this family, organized by ATT&CK tactic.
This approach has some interesting traits: blends with legit traffic - all calls go to dev.azure.com . no additional infra needed - the “C2” is a Microsoft service.
Azure DevOps REST API - a totally legit Microsoft service - can be used by an attacker to communicate with their infrastructure in unexpected ways... your Azure DevOps “C2 server” is ready for abuse. | The simplest way to talk to Azure DevOps REST API is to hit an endpoint... blends with legit traffic - all calls go to dev.azure.com.
creating a work item with a title and a description containing arbitrary text - a “safe” stand-in for sensitive data in a stealer scenario.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.