Vietnamese hacking group uses malware to steal financial data across Asia

CoralRaider, a threat group suspected of originating from Vietnam, has been observed since at least May 2023 targeting victims in several Asian and Southeast Asian countries with malware attacks aimed at stealing valuable data.

CoralRaider is a financially motivated threat actor group. The group's campaigns target countries including India, China, South Korea, Bangladesh, Pakistan, Indonesia, and Vietnam. The group focuses on stealing victims' credentials, financial data, and social media accounts, including business and advertising accounts. The malware payloads they use include RotBot (a customized variant of QuasarRAT) and XClient Stealer.

Other commodity malware used by the group includes Remote Access Trojans and information stealers, such as AsyncRAT, NetSupport RAT, and Rhadamanthys.

The threat group's specific focus on stealing business and advertising accounts, as found in the analysis of campaigns targeting Vietnam, involves using malware like Ducktail, NodeStealer, and VietCredCare to control these accounts for further monetization. They leverage Telegram to exfiltrate stolen information from victims' machines and then trade it on underground markets for illicit revenue.

Researchers noted: "Based on the threat actor's messages in their Telegram C&C bot channels, as well as their linguistic preferences when naming the bots, PDB strings, and other Vietnamese words hardcoded in the payload binaries, it is estimated that CoralRaider's operators are located in Vietnam."

The infection chain typically begins with a Windows Shortcut (LNK) file, although it is currently unclear how these files are distributed to targets.

If the LNK file is opened, an HTML Application (HTA) file is downloaded and executed from an attacker-controlled download server, which in turn runs an embedded Visual Basic script.

This script sequentially decrypts and executes three other PowerShell scripts, which are responsible for performing anti-VM and anti-analysis checks, bypassing Windows User Account Control (UAC), disabling Windows and application notifications, and downloading and running RotBot, among other operations.

RotBot is configured to contact a Telegram bot, retrieve the XClient Stealer malware, and execute it in memory, ultimately facilitating the theft of cookies, credentials, and financial information from web browsers such as Brave, Cốc Cốc, Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera, as well as platforms like Discord and Telegram.

XClient is also designed to steal data from victims' accounts on Facebook, Instagram, TikTok, and YouTube, collecting details on payment methods and permissions associated with their Facebook business and ad accounts.

RotBot is a variant of the Quasar RAT client, customized and compiled by the attackers for this campaign. [XClient] features extensive information-stealing capabilities based on plugin modules and various modules that execute remote administration tasks.

Bitdefender disclosed details of a malicious advertising campaign on Facebook leveraging buzz around generative AI tools to promote various information-stealing tools, such as Rilide, Vidar, IceRAT, and a new threat actor called Nova Stealer.

The starting point of the attack is for attackers to take over existing Facebook accounts and modify their appearance to mimic well-known AI tools like Google, OpenAI, and Midjourney, expanding their reach by running sponsored ads on the platform.

One such page impersonating Midjourney had 1.2 million followers before being taken down on March 8, 2023. The attackers managing this page primarily originated from countries including Vietnam, the US, Indonesia, the UK, and Australia.

Attack simulation rules targeting the tactics employed by this hacking group have been integrated into the SecurityGauge security measurement and verification platform. You can search for keywords such as "QuasarRAT", "AsyncRAT", "NetSupport RAT", "Ducktail", and "Vidar" in the SecurityGauge platform to obtain relevant attack simulation verification actions. This allows you to verify whether your security defense system can effectively counter the attacks of this hacking group. The platform ensures your verification process is safe and harmless in an industry-unique manner.