Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT

Summary: Unit 42 identified the NOKKI malware family in attacks using politically-motivated lures against Russian and Cambodian speakers, and found a link to the Reaper threat actor group, which other security organizations have attributed to North Korea. The most recent cluster, beginning in July 2018, used malicious Microsoft Word macros to deliver a previously unreported dropper Unit 42 named Final1stspy, which in turn loads the DOGCALL remote access Trojan that uploads stolen data to third-party cloud storage such as pCloud, Dropbox, Box and Yandex Cloud.

Why it matters: DOGCALL sends what it steals through legitimate cloud services like pCloud and Dropbox, so the exfiltration traffic looks like ordinary SaaS use rather than a blocked command-and-control channel. The World Cup lure sample also carried commented-out text about Kim Jong Un's Singapore summit, tying the tooling to an actor attributed to North Korea.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related