Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa

Jan 18, 2023Ravie LakshmananCyber Threat / Malware

An ongoing campaign dubbed Earth Bogle is
leveraging geopolitical-themed lures to deliver the NjRAT remote
access trojan to victims across the Middle East and North
Africa.

“The threat actor uses public cloud storage services such as
files[.]fm and failiem[.]lv to host malware, while compromised web
servers distribute NjRAT,” Trend Micro said^[1]
in a report published Wednesday.

Phishing emails, typically tailored to the victim’s interests,
are loaded with malicious attachments to activate the infection
routine. This takes the form of a Microsoft Cabinet (CAB) archive
file containing a Visual Basic Script dropper to deploy the
next-stage payload.

Alternatively, it’s suspected that the files are distributed via
social media platforms such as Facebook and Discord, in some cases
even creating bogus accounts to serve ads on pages impersonating
legitimate news outlets.

The CAB files, hosted on cloud storage services, also masquerade
as sensitive voice calls to entice the victim into opening the
archive, only for the VBScript to be executed, leading to the
retrieval of another VBScript file that masks itself as an image
file.

The second-stage VBScript, for its part, fetches from an already
breached domain a PowerShell script that’s responsible for loading
the RAT payload into memory and executing it.

NjRAT (aka Bladabindi), first discovered in 2013, has myriad
capabilities that allow the threat actor to harvest sensitive
information and gain control over compromised computers.

“This case demonstrates that threat actors will leverage public
cloud storage as malware file servers, combined with social
engineering techniques appealing to people’s sentiments such as
regional geopolitical themes as lures, to infect targeted
populations,” the researchers concluded.