Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Tracking Ocean Lotus’ new Downloader, Kerr Down

Summary: Unit 42 documented a new OceanLotus (APT32) downloader family it named KerrDown, in use since at least early 2018, delivered either through a Microsoft Office document with a malicious macro or a RAR archive using DLL side-loading against a legitimate Microsoft Word 2007 executable. The macro lure carries two base64-encoded DLLs in tables with font size set to 1, picks one based on whether the victim runs 64-bit or 32-bit Windows, drops it as main_background.png under Users\Administrator\AppData\Roaming\, and the DLL decrypts a DES-encrypted payload from a URL and runs it in memory, with the still-active payload link yielding a Cobalt Strike Beacon variant.

Bottom line: The final payload here is Cobalt Strike Beacon, a commercial penetration testing tool, fetched by a downloader that never writes the payload to disk - so file-based detection sees only a PNG-named DLL. Unit 42's compile-timestamp analysis points to formal working hours in a Vietnam-like time zone, and the group's known target base extends beyond the Vietnamese-speaking victims seen in this campaign.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related