LodaRAT: Established Malware, New Victim Patterns

Category	Details
Threat Actors	Unknown, potentially a wide range of actors using LodaRAT, as the source code is publicly available and customizable.
Campaign Overview	An ongoing malware campaign using a new version of LodaRAT, a remote access tool (RAT) that has evolved over 8 years. This new version focuses on stealing cookies and passwords from Microsoft Edge and Brave. The malware is distributed through DonutLoader and CobaltStrike.
Target Regions (Victims)	Victims are worldwide, with about 30% of VirusTotal samples originating from the USA.
Methodology	- Distributed via trojanized software. - Uses phishing and known vulnerability exploitation in earlier versions; now uses DonutLoader and CobaltStrike. - LodaRAT masquerades as legitimate software (Discord, Skype, Windows Update).
Product Targeted	Microsoft Edge, Brave browsers (for cookie and password stealing), and general Windows systems for RAT operations.
Malware Reference	LodaRAT
Tools Used	- DonutLoader, CobaltStrike (for distribution) - ngrok reverse proxy utility, SMB lateral movement tools (for further infection) - AutoIt (RAT tool)
Vulnerabilities Exploited	Phishing, known vulnerability exploitation (T1203), masquerading as legitimate software (T1036).
TTPs	- Masquerading as legitimate software. - Establishing persistence via registry modification (T1547.001) or scheduled tasks (T1053). - Data exfiltration and screen capturing (T1113). - C2 communication for commands.
Attribution	Originally attributed to Kasablanka APT in 2021, but the 2024 campaign shows a shift in target scope, making attribution unclear.
Recommendations	- Use detection tools like Rapid7 InsightIDR for visibility. - Regularly update systems and security tools. - Be cautious of phishing attempts and fake software installers. - Ensure proper firewall configuration.
Source	Rapid7

Read full article: https://www.rapid7.com/blog/post/2024/11/12/lodarat-established-malware-new-victim-patterns/

Disclaimer: The above summary has been generated by an AI language model