Uncovered: APT ‘Hackers For Hire’ Target Financial, Entertainment Firms

A hackers-for-hire operation has been discovered using a strain
of previously undocumented malware to target South Asian financial
institutions and global entertainment companies.

Dubbed “CostaRicto^[1]” by Blackberry
researchers, the campaign appears to be the handiwork of APT
mercenaries who possess bespoke malware tooling and complex VPN
proxy and SSH tunneling capabilities.

“CostaRicto targets are scattered across different countries in
Europe, Americas, Asia, Australia and Africa, but the biggest
concentration appears to be in South Asia (especially India,
Bangladesh and Singapore and China), suggesting that the threat
actor could be based in that region, but working on a wide range of
commissions from diverse clients,” the researchers said.

The modus operandi in itself is quite straight-forward. Upon
gaining an initial foothold in the target’s environment via stolen
credentials, the attacker proceeds to set up an SSH tunnel to
download a backdoor and a payload loader called CostaBricks that
implements a C++ virtual machine mechanism to decode and inject the
bytecode payload into memory.

In addition to managing command-and-control (C2) servers via
DNS tunneling^[2], the backdoor delivered
by the above-mentioned loaders is a C++ compiled executable called
SombRAT — so named after Sombra^[3], a Mexican hacker, and
infiltrator from the popular multiplayer game Overwatch.

The backdoor comes equipped with 50 different commands to carry
out specific tasks (can be categorized in core, taskman, config,
storage, debug, network functions) that range from injecting
malicious DLLs into memory to enumerating files in storage to
exfiltrating the captured data to an attacker-controlled
server.

In all, six versions of SombRAT have been identified, with the
first version dating all the way back to October 2019 and the
latest variant observed earlier this August, implying that the
backdoor is under active development.

While the identities of the crooks behind the operation are
still unknown, one of the IP addresses to which the backdoor
domains were registered has been linked to an earlier phishing
campaign attributed to Russia-linked APT28^[4]
hacking group, hinting at the possibility that the phishing
campaigns could have been outsourced to the mercenary on behalf of
the actual threat actor.

This is the second hackers-for-hire operation uncovered by
Blackberry, the first being a series of campaigns by a group called
Bahamut^[5]
that was found to exploit zero-day flaws, malicious software, and
disinformation operations to track targets located in the Middle
East and South Asia.

“With the undeniable success of Ransomware-as-a-Service (RaaS),
it’s not surprising that the cybercriminal market has expanded its
portfolio to add dedicated phishing and espionage campaigns to the
list of services on offer,” Blackberry researchers said.

“Outsourcing attacks or certain parts of the attack chain to
unaffiliated mercenary groups has several advantages for the
adversary — it saves their time and resources and simplifies the
procedures, but most importantly it provides an additional layer of
indirection, which helps to protect the real identity of the threat
actor.”