In new campaigns spotted across Asia, ObliqueRAT, a notorious remote access Trojan (RAT), is hiding in benign image files on hijacked websites.
The ObliqueRAT Remote Access Trojan, first discovered in early 2020, has been used in attacks against organizations in South Asia.
It evolved from being a typical RAT with the functionality of a Trojan that focused on data theft – with capabilities to connect to a command-and-control (C2) server, exfiltrate files, and terminate existing processes – to a malware that utilizes a wider set of initial infection vectors and uses new ways to get into the victim’s systems.
In a blog post on Tuesday, Cisco Talos explains that previously, Microsoft Office documents were sent via phishing emails that contained malicious macros leading to the direct deployment of ObliqueRAT. Now, however, the attackers direct victims to malicious websites, apparently, in an attempt to circumvent email security checks.
Cisco Talos found four new versions of the malware that appear to have been developed between April and November 2020.
TOf particular interest is a technique the attackers used called steganography. It is used to hide code, files, images, and video content within other content of file formats. In the attacks in Asia, bad actors hid malicious ObliqueRAT payloads in .BMP image files. While the files contain regular image data, executable code is concealed in RGB data.
Websites that host these infected .BMP files get compromised when the files are viewed. This triggers the download of a .ZIP file containing ObliqueRAT from the attackers’ server.
The researchers found that the cybercriminals used the malicious macros contained in the infected files to extract the archive file and deploy the Trojan on the target system.
The new version of ObliqueRAT can check whether endpoints have been blocklisted and search for computer names. It also got the ability to extract files from external storage and a new command prompt that hasn’t been used yet, which indicates that additional updates will occur in the future.
