Ande Loader Malware Targets Manufacturing Sector in North America

Mar 14, 2024NewsroomCyber Risk / Malware

The risk actor often called Blind Eagle has been noticed utilizing a loader malware known as Ande Loader to ship distant entry trojans (RATs) like Remcos RAT and NjRAT.

The assaults, which take the type of phishing emails, focused Spanish-speaking customers within the manufacturing business based mostly in North America, eSentire stated.

Blind Eagle (aka APT-C-36) is a financially motivated risk actor that has a historical past of orchestrating cyber assaults towards entities in Colombia and Ecuador to ship an assortment of RATs, together with AsyncRAT, BitRAT, Lime RAT, NjRAT, Remcos RAT, and Quasar RAT.

The most recent findings mark an growth of the risk actor’s focusing on footprint, whereas additionally leveraging phishing emails bearing RAR and BZ2 archives to activate the an infection chain.

The password-protected RAR archives include a malicious Visible Primary Script (VBScript) file that is liable for establishing persistence within the Home windows Startup folder and launching the Ande Loader, which, in flip, hundreds the Remcos RAT payload.

In another assault sequence noticed by the Canadian cybersecurity agency, a BZ2 archive containing a VBScript file is distributed by way of a Discord content material supply community (CDN) hyperlink. The Ande Loader malware, on this case, drops NjRAT as a substitute of Remcos RAT.

“Blind Eagle risk actor(s) have been utilizing crypters written by Roda and Pjoao1578,” eSentire stated. “One of many crypters developed by Roda has the hardcoded server internet hosting each injector parts of the crypter and extra malware that was used within the Blind Eagle marketing campaign.”

The event comes as SonicWall make clear the internal workings of one other loader malware household known as DBatLoader, detailing its use of a legitimate-but-vulnerable driver related to RogueKiller AntiMalware software program (truesight.sys) to terminate safety options as a part of a Carry Your Personal Susceptible Driver (BYOVD) assault and finally ship Remcos RAT.

“The malware is acquired inside an archive as an e mail attachment and is very obfuscated, containing a number of layers of encryption knowledge,” the corporate famous earlier this month.