Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Updated KHRAT Malware Used in Cambodia Attacks

Summary: Unit 42 observed KHRAT, a Remote Access Trojan that registers victims by infected machine username, system language and local IP address and provides keylogging, screenshots and remote shell access, being used against Cambodian citizens, with just over fifty network sessions seen across its sensors since the start of the year. On June 21, 2017 a weaponized Word document named for the World Bank-funded Mekong Integrated Water Resources Management Project was uploaded to Wildfire and shown contacting Russian IP address 194.87.94[.]61 over port 80 via a GET request to update.upload-dropbox[.]com, a lookalike domain meant to pass as Dropbox.

What you should know: The lure borrowed the name of a multi-million dollar World Bank water project in its third phase, and the payload was hosted on a compromised Cambodian government website - the credibility of the project and the site did the work that malware alone could not.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related