Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A second branch installed ARKTunnel, an undocumented remote-access tool that hid its payload inside a bitmap image.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
“The group runs a pay-per-install service, using YouTube channels and SEO-poisoning campaigns to distribute malware through a custom loader.”
“The SEO funnel delivered trojanized software to corporate, government, and critical infrastructure targets.”
ARKTunnel... created a delayed-start Windows service.
ARKTunnel... created a delayed-start Windows service.
ARKTunnel... hid its payload inside a bitmap image... Hiding data in an image made the final payload less obvious in quick reviews.
“OfferLoader masquerading as a windirstat.exe installer”; it was also delivered alongside legitimate WinRAR renamed to “.store.”
“It then contacts its C2 servers via an HTTPS POST request to /d” and “POST requests to /d for tasks and POST requests to /e for error reporting.”
It created a delayed-start Windows service and could tunnel TCP or UDP traffic and run files.
“The RAT supports TCP and UDP tunneling, as well as file execution.”
OfferLoader used a trojanized Inno Setup installer to start the next stages. After a tracking check, it launched three child processes for separate malware operations.
After a tracking check, it launched three child processes for separate malware operations... [Insomnia RAT] can... download files... The third branch... side-loaded a browser extension.
[ARKTunnel] could tunnel TCP or UDP traffic and run files.
107 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.