Kasablanka Group's LodaRAT improves espionage capabilities on Android and Windows

Summary: Cisco Talos reports that the group it calls "Kasablanca" has built Loda4Android, an Android RAT sharing the C2 protocol and infrastructure of its Windows LodaRAT, with both versions reporting to the same hostname and port. The campaign, active since October 2020, targets Windows and Android users, with lures aimed at Bangladesh-based banks and carrier-grade VoIP vendors, and the Windows version's default victim ID is "munafa," the Urdu and Bengalese word for "profit."
What you should know: The operators have a stated interest in Bangladesh-based banks and VoIP vendors, and their Windows RAT now includes a command that reconfigures Windows security settings to open remote desktop access over port 3389 - so a single opened RTF document can hand an intruder a logged-in session on the machine.

Read the original at Cisco Talos ↗

Topics: Malware
Mentions: CVE-2017-11882
Related: My Little Form Book Cyber Risks ·
Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox Cyber Risks ·
SWEED: Exposing years of Agent Tesla campaigns Cyber Risks ·