Ande Loader Malware Targets Manufacturing Sector in North America

Mar 14, 2024NewsroomCyber Risk / Malware

The risk actor often called Blind Eagle has been noticed utilizing a loader malware known as Ande Loader to ship distant entry trojans (RATs) like Remcos RAT and NjRAT.

The assaults, which take the type of phishing emails, focused Spanish-speaking customers within the manufacturing business based mostly in North America, eSentire mentioned.

Blind Eagle (aka APT-C-36) is a financially motivated risk actor that has a historical past of orchestrating cyber assaults towards entities in Colombia and Ecuador to ship an assortment of RATs, together with AsyncRAT, BitRAT, Lime RAT, NjRAT, Remcos RAT, and Quasar RAT.

The most recent findings mark an enlargement of the risk actor’s focusing on footprint, whereas additionally leveraging phishing bearing RAR and BZ2 archives to activate the an infection chain.

The password-protected RAR archives include a malicious Visible Fundamental Script (VBScript) file that is chargeable for establishing persistence within the Home windows Startup folder and launching the Ande Loader, which, in flip, hundreds the Remcos RAT payload.

In an alternate assault sequence noticed by the Canadian cybersecurity agency, a BZ2 archive containing a VBScript file is distributed through a Discord content material supply community (CDN) hyperlink. The Ande Loader malware, on this case, drops NjRAT as an alternative of Remcos RAT.

“Blind Eagle risk actor(s) have been utilizing crypters written by Roda and Pjoao1578,” eSentire mentioned. “One of many crypters developed by Roda has the hardcoded server internet hosting each injector parts of the crypter and extra malware that was used within the Blind Eagle marketing campaign.”

The event comes as SonicWall make clear the inside workings of one other loader malware household known as DBatLoader, detailing its use of a legitimate-but-vulnerable driver related to RogueKiller AntiMalware software program (truesight.sys) to terminate safety software program as a part of a Convey Your Personal Weak Driver (BYOVD) assault and in the end ship Remcos RAT.

“The malware is obtained inside an archive as an e mail attachment and is very obfuscated, containing a number of layers of encryption information,” the corporate famous earlier this month.