Introduction to Atlas RAT Malware
A Chinese-speaking cybercrime group, tracked as TA4922, has expanded its targeting to the European space, deploying previously undocumented malware and the Atlas backdoor. This group is associated with financially motivated attacks aimed at breaching target networks for fraud, data theft, and the sale of access.
TA4922 has previously targeted organizations in East Asia, but recent campaigns have focused on entities in Germany, Italy, the United Kingdom, and South Africa. Researchers at cybersecurity company Proofpoint note that TA4922 shares overlaps with activity previously reported as ‘Silver Fox’ and ‘Void Arachne.’ However, the activity cluster is tracked separately as it is more consistent with cybercrime than espionage.
TA4922's Operational Diversity and Tempo
Since March, TA4922’s activity has increased sharply, and since April, it has shown unprecedented operational diversity and high tempo. According to Proofpoint, TA4922 currently conducts more unique campaigns than any other tracked cybercrime threat actor in Proofpoint threat data, demonstrating high operational tempo, a variety of lures, and multiple objectives.
While the actor is assessed to be financially motivated, the capabilities of the malware include the potential for surveillance, which could be used by or sold to espionage groups. The attacker uses localized phishing lures crafted to appear as payroll notices, tax audits, VAT filings, government compliance notices, invoices, and human resources communications.
Attack Vectors and Tactics
The threat group also attempts to contact victims via WhatsApp, the LINE messenger, and Microsoft Teams. The use of these platforms indicates a shift towards more personalized and targeted attacks, increasing the likelihood of successful infection.
German lure, for instance, is used to trick victims into opening malicious attachments or clicking on phishing links. This tactic, combined with the use of legitimate remote management tools like AnyDesk and SyncFuture, allows the attackers to maintain a low profile while still achieving their objectives.
Atlas RAT and Custom Loaders
Proofpoint reports that TA4922 has significantly expanded its malware arsenal and believes the hackers may be using large language models (LLMs) to accelerate malware development. This conclusion is based on the presence of placeholder values, code comments, and patterns commonly associated with AI-generated code.
The Atlas RAT offers attackers the following capabilities: system reconnaissance, targeted file theft, plugin and payload downloads, keylogging, screenshot capturing, audio and webcam recording, and system shutdown/reboot commands. The malware features several anti-sandbox and anti-analysis checks, including looking for usernames and registry keys associated with Microsoft Defender Application Guard, the “CExecSvc” service, and OS UUID.
Other Malware Loaders and Tools
The researchers also discovered a new malware loader named RomulusLoader, which downloads and executes additional payloads using process hollowing, shellcode injection, and direct execution. RomulusLoader was deployed to launch legitimate remote management tools such as AnyDesk and SyncFuture, a remote monitoring software tool popular in China.
Additionally, Proofpoint identified a Python-based loader and information stealer called SilentRunLoader, which steals Google Chrome credentials, cookies, and browsing data. That malware was deployed against organizations in the United Kingdom and Southeast Asia, using lures that impersonated government services.
Finally, the researchers spotted the deployment of Winos4.0, a previously documented malware family that Proofpoint tracks as ValleyRAT and which provides operators with a full set of remote access features.
Conclusion and Recommendations
According to Proofpoint, TA4922 is responsible for "more unique campaigns" than any other threat actor the company tracks. The group is moving quickly and uses multiple lures. The capabilities of the malware used by this actor have "the potential for surveillance which could be used by or sold to espionage groups."
Proofpoint's report includes indicators of compromise for the malware and command-and-control (C2) infrastructure used in TA4922's attacks. It is essential for security teams to stay vigilant and implement robust security measures to detect and prevent such attacks.
- Implement robust email filters to block phishing emails.
- Use strong antivirus software and keep it up-to-date.
- Regularly update operating systems and software.
- Use strong passwords and enable two-factor authentication.
- Provide regular security awareness training to employees.
Source: BleepingComputer