Technology NewsEarth Bogle Campaign Unleashes NjRAT Trojan on Middle East...

Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa

-


Jan 18, 2023Ravie LakshmananCyber Threat / Malware

Earth Bogle Campaign Unleashes NjRAT Trojan on Middle East and North Africa

An ongoing campaign dubbed Earth Bogle is leveraging geopolitical-themed lures to deliver the NjRAT remote access trojan to victims across the Middle East and North Africa.

“The threat actor uses public cloud storage services such as files[.]fm and failiem[.]lv to host malware, while compromised web servers distribute NjRAT,” Trend Micro said in a report published Wednesday.

Phishing emails, typically tailored to the victim’s interests, are loaded with malicious attachments to activate the infection routine. This takes the form of a Microsoft Cabinet (CAB) archive file containing a Visual Basic Script dropper to deploy the next-stage payload.

Alternatively, it’s suspected that the files are distributed via social media platforms such as Facebook and Discord, in some cases even creating bogus accounts to serve ads on pages impersonating legitimate news outlets.

The CAB files, hosted on cloud storage services, also masquerade as sensitive voice calls to entice the victim into opening the archive, only for the VBScript to be executed, leading to the retrieval of another VBScript file that masks itself as an image file.

NjRAT Trojan

The second-stage VBScript, for its part, fetches from an already breached domain a PowerShell script that’s responsible for loading the RAT payload into memory and executing it.

NjRAT (aka Bladabindi), first discovered in 2013, has myriad capabilities that allow the threat actor to harvest sensitive information and gain control over compromised computers.

“This case demonstrates that threat actors will leverage public cloud storage as malware file servers, combined with social engineering techniques appealing to people’s sentiments such as regional geopolitical themes as lures, to infect targeted populations,” the researchers concluded.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.



LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest news

Do you want a secure email? Here are the top 5 solutions

Free providers don't take care of our data, but the good news is that you don't have to...

Google Pixel Watch receives February 2023 update featuring latest security patches

A new update has been pushed to Google Pixel Watch devices, giving users access to important security patches....

Is it a tablet or a laptop? This is the new Xiaomi Book that the firm is preparing

Xiaomi will present a renewal of its convertible and economic concept with Windows 11 very soon in China....

காலநிலை மாற்றம் ஒரு பெருங்கடலை “பேரழிவை” ஏற்படுத்தலாம்

மோசமான வெப்பமயமாதலின் கீழ், தெற்கு மெரிடியனல் ஓவர்டர்னிங் சர்குலேஷன் 2300 இல் முற்றிலும் நிறுத்தப்படலாம் என்று உருவகப்படுத்துதல்கள் தெரிவிக்கின்றன.வலுவான வெப்பமயமாதல் ஆழமான கவிழ்ப்பு சுழற்சியை...

Aaron Finch: “I will not be able to play in 2024 World Cup. In the interest of the team…” Finch announces retirement | ...

Aaron Finch, who made his T20 debut against Sri Lanka in 2011, has played 103 T20 Internationals so...

Is it a tablet or a laptop? This is the new Xiaomi Book that the firm is preparing

Xiaomi will present a renewal of its convertible and economic concept with Windows 11 very soon in China....

Must read