BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger
Summary: Unit 42 reports that the Roaming Tiger campaign, first documented by ESET in late 2014, continued from August 2015 with attacks concentrated in late October through December against Russia and other Russian-speaking nations, using weaponized documents that exploit CVE-2012-0158 and leave Russian-language decoy files. The new malware, named BBSRAT, uses PlugX-like infection mechanisms but is a distinct tool that sideloads through a legitimate Citrix ssonsvr.exe, hollows msiexec.exe, and beacons to C2 domains including transactiona[.]com and futuresgold[.]com.
Why it matters: The adversary kept operating after its TTPs and C2 servers had been public for over a year, and the newer BBSRAT samples show no overlap in C2 infrastructure across hashes and IPs, suggesting purpose-built variants per target - so published indicators alone will not catch the next victim's build.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Mentions
- CVE-2012-0158
- Related
- CVE-2012-0158: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021It's not the Dalai Lama's birthday, oh and you got owned Cyber Risks ·