COVID-Themed Lures Target SCADA Sectors With Data Stealing Malware

The targeted attacks employ Microsoft Word documents as droppers
to deploy a previously unknown Python-based RAT dubbed “PoetRAT”
due to various references to sonnets by English playwright William
Shakespeare.

“The RAT has all the standard features of this kind of malware,
providing full control of the compromised system to the operation,”
said Cisco
Talos^[1] in an analysis published
last week.

According to the researchers, the malware specifically targets
supervisory control and data acquisition (SCADA) systems in the
energy industry, such as wind turbine systems, whose identities are
currently not known.

The development is the latest in a surge in
cyberattacks exploiting the ongoing coronavirus
pandemic fears as bait to install malware, steal information,
and make a profit.

Using COVID-19 Themed Lures as Decoy

The campaign works by appending PoetRAT to a Word document, which,
when opened, executes a macro that extracts the malware and runs
it.

The exact distribution mechanism of the Word document remains
unclear, but given that the documents are available for download
from a simple URL, the researchers suspect that victims are being
tricked into downloading the RAT via malicious URLs or phishing
emails.

Talos said it discovered that attack in three waves starting in
February, some of which used decoy documents claiming to be from
Azerbaijan government agencies and India’s Defense Research and
Development Organization (DRDO), or alluding to COVID-19 in their
file names (“C19.docx”) without any actual content.

The Python script also checks the environment where the document
is being opened to make sure it’s not in a sandbox — based on the
assumption that sandboxes have hard drives smaller than 62GB. If it
detects a sandboxed environment, it deletes itself from the
system.

Making Registry Modifications to Gain Persistence

As for the RAT, it comes with two scripts: a “frown.py” that’s
responsible for communicating with a remote command-and-control
(C2) server with a unique device identifier, and a “smile.py” that
handles the execution of C2 commands on the compromised
machine.
The commands make it possible for an attacker to upload sensitive
files, capture screenshots, terminate system processes, log
keystrokes (“Klog.exe”), and steal passwords stored in browsers
(“Browdec.exe”).

Besides this, the adversary behind the campaign also deployed
additional exploitation tools, including “dog.exe,” a .NET-based
malware that monitors hard drive paths, and automatically transmits
the information via an email account or an FTP. Another tool called
“Bewmac” enables the attacker to seize control of the victim’s
webcam.

The malware gains persistence by creating registry keys to
execute the Python script and can even make registry modifications
to bypass the aforementioned sandbox evasion check, possibly to
avoid re-checking the same environment again.

“The actor monitored specific directories, signaling they wanted
to exfiltrate certain information on the victims,” Talos
researchers concluded.

“The attacker wanted not only specific information obtained from
the victims but also a full cache of information relating to their
victim. By using Python and other Python-based tools during their
campaign, the actor may have avoided detection by traditional tools
that have whitelisted Python and Python execution techniques.”

^[2][3]