Digitally Signed Bandook Malware Once Again Targets Multiple Sectors

A cyberespionage group with suspected ties to the Kazakh and
Lebanese governments has unleashed a new wave of attacks against a
multitude of industries with a retooled version of a 13-year-old
backdoor Trojan.

Check Point Research called out hackers affiliated with a group
named Dark Caracal^[1]
in a new report^[2]
published yesterday for their efforts to deploy “dozens of
digitally signed variants” of the Bandook^[3]
Windows Trojan over the past year, thus once again “reigniting
interest in this old malware family.”

The different verticals singled out by the threat actor include
government, financial, energy, food industry, healthcare,
education, IT, and legal institutions located in Chile, Cyprus,
Germany, Indonesia, Italy, Singapore, Switzerland, Turkey, and the
US.

The unusually large variety of targeted markets and locations
“reinforces a previous hypothesis that the malware is not developed
in-house and used by a single entity, but is part of an offensive
infrastructure sold by a third party to governments and threat
actors worldwide, to facilitate offensive cyber operations,” the
researchers said.

Dark Caracal’s extensive use of Bandook RAT to execute espionage
on a global scale was first documented^[4]
by the Electronic Frontier Foundation (EFF) and Lookout in early
2018, with the group attributed to the theft of enterprise
intellectual property and personally identifiable information from
thousands of victims spanning over 21 countries.

The prolific group, which has operated at least since 2012, has
been linked to the Lebanese General Directorate of General Security
(GDGS), deeming it a nation-state level advanced persistent
threat.

The concurrent use of the same malware infrastructure by
different groups for seemingly unrelated campaigns led the EFF and
Lookout to surmise that the APT actor “either uses or manages the
infrastructure found to be hosting a number of widespread, global
cyberespionage campaigns.”

Now the same group is back at it with a new strain of Bandook,
with added efforts to thwart detection and analysis, per Check
Point Research.

A Three-Stage Infection Chain

The infection chain is a three-stage process that begins with a
lure Microsoft Word document (e.g. “Certified documents.docx”)
delivered inside a ZIP file that, when opened, downloads malicious
macros, which subsequently proceeds to drop and execute a
second-stage PowerShell script encrypted inside the original Word
document.

In the last phase of the attack, this PowerShell script is used
to download encoded executable parts from cloud storage services
like Dropbox or Bitbucket in order to assemble the Bandook loader,
which then takes the responsibility of injecting the RAT into a new
Internet Explorer process.

The Bandook RAT — commercially available starting in 2007 —
comes with all the capabilities typically associated with backdoors
in that it establishes contact with a remotely-controlled server to
receive additional commands ranging from capturing screenshots to
carrying out various file-related operations.

But according to the cybersecurity firm, the new variant of
Bandook is a slimmed-down version of the malware with support for
only 11 commands, while prior versions were known to feature as
many as 120 commands, suggesting the operators’ desire to reduce
the malware’s footprint and evade detection against high-profile
targets.

That’s not all. Not only valid certificates issued by Certum
were used to sign this trimmed version of the malware executable,
Check Point researchers uncovered two more samples — full-fledged
digitally-signed and unsigned variants — which they believe are
operated and sold by a single entity.

“Although not as capable, nor as practiced in operational
security like some other offensive security companies, the group
behind the infrastructure in these attacks seems to improve over
time, adding several layers of security, valid certificates and
other techniques, to hinder detection and analysis of its
operations,” the researchers concluded.