Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
One branch deployed Insomnia RAT, a dual Node.js and Python backdoor for Windows and macOS.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
“Plus de 200 domaines rotatifs suivant un pattern de nommage en deux mots composés.”
“The group runs a pay-per-install service, using YouTube channels and SEO-poisoning campaigns to distribute malware through a custom loader.”
Its installer... created scheduled tasks for persistence.
a.dll, PowerShell downloader for Insomnia RAT stages; t.ps1, Insomnia RAT PowerShell loader.
Python component of the Insomnia RAT dual payload.
Node.js component of the Insomnia RAT dual payload.
“The SEO funnel delivered trojanized software to corporate, government, and critical infrastructure targets.”
Its installer... created scheduled tasks for persistence.
The TTP list identifies T1112; Insomnia RAT is described as installing Node.js with “SystemComponent=1.”
Its installer... created scheduled tasks for persistence.
“OfferLoader masquerading as a windirstat.exe installer”; it was also delivered alongside legitimate WinRAR renamed to “.store.”
“installe Node.js masqué (SystemComponent=1)” and the TTP list identifies T1036.005.
The TTP list identifies T1112; Insomnia RAT is described as installing Node.js with “SystemComponent=1.”
Its installer disabled Microsoft Defender protections, added the whole C: drive to the exclusion list.
The backdoor can collect system identifiers, receive commands, download files, and report results to its controllers.
“Envoie un beacon de tracking à voyagemist[.]space” and “User-agent C2 : insomnia/2023.4.0 Windows.”
OfferLoader used a trojanized Inno Setup installer to start the next stages. After a tracking check, it launched three child processes for separate malware operations.
After a tracking check, it launched three child processes for separate malware operations... [Insomnia RAT] can... download files... The third branch... side-loaded a browser extension.
112 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.