Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cardinal RAT Sins Again, Targets Israeli Fin-Tech Firms

Summary: Unit 42 reports an updated Cardinal RAT, version 1.7.2, delivered through a .NET loader that hides a DLL in an embedded bitmap and decrypts it with a single-byte XOR key, then uses a hidden Windows 'choice' command as a 20-second sleep and renames all functions and variables to MD5 hashes. Since April 2017 the malware has been seen against two customers, both Israeli FinTech firms writing forex and cryptocurrency trading software, and researchers found a possible link to the JavaScript-based EVILNUM family, which hit the same target in a short window.

What's compelling: Two rare malware families appearing at one Israeli FinTech target within days, with droppers sharing similarly themed lure documents, points to attackers who pick a sector and stay on it; Unit 42 says it could not see what happens after access is gained but assesses the goal is financial gain.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related