Researchers Unmask Hackers Behind APOMacroSploit Malware Builder

Cybersecurity researchers have disclosed a new kind of Office
malware distributed as part of a malicious email campaign that
targeted more than 80 customers worldwide in an attempt to control
victim machines and steal information remotely.

The tool — dubbed “APOMacroSploit^[1]” — is a macro exploit
generator that allows the user to create an Excel document capable
of bypassing antivirus software, Windows Antimalware Scan Interface
(AMSI), and even Gmail and other email-based phishing
detection.

APOMacroSploit is believed to be the work of two French-based
threat actors “Apocaliptique” and “Nitrix,” who are estimated to
have made at least $5000 in less than two months selling the
product on HackForums.net.

About 40 hackers in total are said to be behind the operation,
utilizing 100 different email senders in a slew of attacks
targeting users in more than 30 different countries. The attacks
were spotted for the first time at the end of November 2020,
according to cybersecurity firm Check Point.

“The malware infection begins when the dynamic content of the
attached XLS document is enabled, and an XLM macro automatically
starts downloading a Windows system command script,” the firm said
in a Tuesday report.

This system command script is retrieved from cutt.ly, which
directs to servers hosting multiple BAT scripts that have the
nickname of the customers inserted attached to the filenames. The
scripts are also responsible for executing the malware (“fola.exe”)
on Windows systems, but not before adding the malware location in
the exclusion path of Windows Defender and disabling Windows
cleanup.

In one of the attacks, the malware — a Delphi Crypter followed
by a second-stage remote access Trojan called BitRAT — was found
hosted on a Bulgarian website catering to medical equipment and
supplies, implying that the attackers breached the website to store
the malicious executable.

The idea of using “crypters^[2]” or “packers” has become
increasingly popular among threat actors to not only compress but
also to make malware samples more evasive and reverse engineer.

BitRAT^[3], which was formally
documented last August, comes with features to mine
cryptocurrencies, hack webcams, log keystrokes, download and upload
arbitrary files, and remotely control the system via a
command-and-control server, which in this case resolved to a
sub-domain of a legitimate Bulgarian website for video surveillance
systems.

Further investigation by Check Point involved chasing the
digital trail left by the two operators — including two League of
Legends player profiles — ultimately leading the researchers to
unmask the real identity of Nitrix, who revealed his actual name on
Twitter when he posted a picture of a ticket he bought for a
concert in December 2014.

While Nitrix is a software developer from Noisy-Le-Grand with
four years of experience as a software developer, Apocaliptique’s
use of alternative names such as “apo93” or “apocaliptique93” has
stirred up possibilities that the individual may also be a French
resident, as “93” is the colloquial name for the French department
of Seine-Saint-Denis^[4].

Check Point Research said it had alerted law enforcement
authorities about the identities of the attackers.