Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef. This operation leverages the SugarGh0st RAT and other malware to target government agencies, research institutions, and various organizations worldwide.
The campaign began in early August 2023 and initially targeted users in Uzbekistan and South Korea. However, it has since expanded to include targets in a wider geographical area, including:
- EMEA: Angola, Turkmenistan, Kazakhstan, India, Saudi Arabia, and Latvia
- Asia: India, Uzbekistan, and Kazakhstan
- Europe: Latvia and Lithuania
The attackers use decoy documents to impersonate government agencies and research institutions and lure victims. These documents include:
- Government-themed lures: Circulars, reports, and announcements from various ministries and embassies
- Research conference-themed lures: Abstracts, application forms, and invitations to conferences
Malware and Infection Chain
Two infection chains utilized a malicious RAR with an LNK file, likely delivered via phishing email.
Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan
According tot the Talos report, The campaign employs the SugarGh0st RAT and another RAT dubbed “SpiceRAT.” The infection chain uses SFX RAR files as the initial attack vector.
When executed, these files drop a decoy document, a DLL loader, encrypted SugarGh0st, and a malicious VB script into the victim’s temporary user profile folder.
The VB script establishes persistence by writing a command to the registry key UserInitMprLogonScript, which executes when a user logs into the system.
The loader DLL reads the encrypted SugarGh0st RAT, decrypts it, and injects it into a process. This technique is similar to that used in a previous SugarGh0st campaign disclosed by the Kazakhstan government in February.
Despite initial disclosure in November 2023, the SneakyChef threat actor continues to leverage old and new command and control (C2) domains.
The C2 domain account[.]drive-google-com[.]tk was still active until mid-May, and a new domain, account[.]gommask[.]online, was created in March 2024.
Indicators of Compromise associated with this threat can be found here.
Mitigation and Response
The discovery of this campaign highlights the importance of robust cybersecurity measures. Organizations should:
- Update security software to include the latest threat definitions.
- Educate employees about phishing attacks and safe email practices.
- Implement advanced network monitoring to detect unusual activities.
- Maintain regular backups of critical data to mitigate the impact of potential breaches.
The ongoing activities of the SneakyChef threat actor underscore the need for continuous vigilance in the digital age.
Free Webinar! 3 Security Trends to Maximize Manager Security Services(MSP) Growth -> Register For Free