Parallax RAT Targeting Cryptocurrency Firms with Sophisticated Injection Techniques

Mar 01, 2023Ravie LakshmananCryptocurrency / Cyber Attack

Cryptocurrency companies are being targeted as part of a new
campaign that delivers a remote access trojan called Parallax
RAT.

The malware “uses injection techniques to hide within legitimate
processes, making it difficult to detect,” Uptycs said^[1]
in a new report. “Once it has been successfully injected, attackers
can interact with their victim via Windows Notepad that likely
serves as a communication channel.”

Parallax RAT^[2]
grants attackers remote access to victim machines. It comes with
features to upload and download files as well as record keystrokes
and screen captures.

It has been put to use since early 2020 and was previously delivered^[3]
via COVID-19-themed lures. In February 2022, Proofpoint detailed^[4]
a cybercrime threat actor dubbed TA2541 targeting aviation,
aerospace, transportation, manufacturing, and defense industries
using different RATs, including Parallax.

The first payload is a Visual C++ malware that employs the
process hollowing^[5]
technique to inject Parallax RAT into a legitimate Windows
component called pipanel.exe^[6].

Parallax RAT, besides gathering system metadata, is also capable
of accessing data stored in the clipboard and even remotely
rebooting or shutting down the compromised machine.

One notable aspect of the attacks is the use of the Notepad
utility to initiate conversations with the victims and instructing
them to connect to an actor-controlled Telegram channel.

Uptycs’ analysis of the Telegram chat reveals that the threat
actor has an interest in crypto companies such as investment firms,
exchanges, and wallet service providers.

The modus operandi entails searching public sources like
DNSdumpster for identifying mail servers belonging to the targeted
companies via their mail exchanger (MX) records and sending phishing emails bearing
the Parallax RAT malware.

The development comes as Telegram is increasingly becoming a hub
for criminal activities, enabling threat actors to organize their
operations, distribute malware, and facilitate the sale of stolen
data, and other illegal goods in part owing to the platform’s lax
moderation efforts.

“One reason why Telegram is attractive to cybercriminals is its
alleged built-in encryption and the ability to create channels and
large, private groups,” KELA disclosed^[7]
in an exhaustive analysis published last month.

“These features make it difficult for law enforcement and
security researchers to monitor and track criminal activity on the
platform. In addition, cybercriminals often use coded language and
alternative spellings to communicate on Telegram, making it even
more challenging to decipher their conversations.”