Sophos found the group abusing NSIS installers and deploying remote access tools (RATs)

Security Researchers at Sophos have found the hacking group that hacked industrial companies using NSIS installers in order to deploy remote access tools (RATs) and info- stealing malwares.The hacking group was "RATicate's" which has been targeting companies from Europe, the Middle East, and the Republic of Korea in not one but five campaigns between November 2019 and January 2020. But Sophos researchers suspect that this group was behind other past attacks too.

These targeted companies were from the industrial sector, particularly companies focused on manufacturing to investment firms and internet companies. Namely,

"an electrical equipment manufacturer in Romania; 
 a Kuwaiti construction services and engineering company;
 a Korean internet company; 
a Korean investment firm;
a British building supply manufacturer; 
a Korean medical news publication; 
Korean telecommunications and electrical cable manufacturer; 
a Swiss publishing equipment manufacturer; 
a Japanese courier and transportation company." 

( as reported by bleeping computer in their blog)

 Two Infection Chains 

The hackers used two infection chains to infect the computers by using phishing emails to deploy payloads but with a small difference.

 The first chain had ZIP, UDF, and IMG attachments carrying NSIS (Nullsoft Scriptable Install System) installers. 
 The second chain had XLS and RTF docs that downloaded the payload from a remote server to the user's machine. 

"We considered two possible scenarios: either the malicious NSIS package is a generic packer sold on dark forums; or, the same threat actor is using a custom loader to deploy different payloads in a variety of their attacks," Sophos reports.

NSIS installers hid the dropped malware by spamming and dropping junk files like images, source code files, shell scripts, and Python binaries.

"During the a ..

Support the originator by clicking the read the rest link below.