"CoralRaider" is of Vietnamese origin and financial motivation

[Father]

Cisco Talos reports the discovery of a new financially motivated attacker, CoralRaider, which has been active since at least May 2023, targeting victims in India, China, South Korea, Bangladesh, Pakistan, Indonesia and Vietnam.

The group is engaged in the theft of accounting and financial data, advertising and business accounts on social networks using malware: RotBot and the stealer XClient.

Other payloads used by the group include a combination of remote access Trojans and information stealers: AsyncRAT, NetSupport RAT and Rhadamanthys.

The actor uses a deadlock technique by abusing a legitimate service to host a C2 configuration file and unusual LoLBins binaries, including Windows Forfiles.exe and FoDHelper.exe.

The analysis showed that the attacker uses a Telegram bot as a C2 to steal victim data from victims’ computers, which is then sold on the darknet and specialized groups on Telegram.

The attack chains begin with a Windows shortcut (LNK) file, although there is currently no clear explanation for how these files are distributed to targets.

If the LNK file is opened, an HTML application (HTA) file is downloaded and executed from an attacker-controlled download server, which in turn runs an embedded Visual Basic script.

The script decrypts and sequentially executes three other PowerShell scripts that are responsible for performing checks, bypassing Windows (UAC), disabling notifications and applications, and downloading and launching RotBot.

RotBot is a variant of the Quasar RAT client that the attacker configured and compiled for this campaign.

It is configured to communicate with the Telegram bot, deliver XClient and execute it in memory, ultimately stealing cookies, credentials and financial information from Brave, Cốc Cốc, Google Chrome, Microsoft Edge, Mozilla Firefox and Opera browsers, as well as Discord data and Telegram.

XClient is also capable of extracting detailed payment method information from victims' Facebook, Instagram, TikTok and YouTube accounts, including those associated with businesses and advertising accounts.

Based on Telegram analytics, language preferences, and IP sightings (in Hanoi), Cisco Talos researchers believe with a high degree of confidence that CoralRaiders are based in Vietnam.

Additional technical details of the attack chain of the uncovered campaign can also be found in the QiAnXin Threat Intelligence Center report.

 

[Father]

According to a new report from Cisco Talos, the CoralRaider group uses CDNs to distribute malware in the United States, Great Britain, Germany, and Japan. The campaign is aimed at stealing credentials, financial information, and social media accounts.

CoralRaider uses LummaC2, Rhadamanthys, and Cryptbot infostilers that are widely available on shadow forums and distributed using the RAAS (Ransomware-as-a-Service) model. Based on an analysis of previous attacks, experts with an "average level of confidence" attribute the CoralRaider campaign.

Infection begins when the victim opens an archive with a malicious LNK shortcut that downloads and executes an encrypted HTA application from a subdomain controlled by hackers on the CDN Bynny platform. By using the CDN cache as a malware delivery server, the hacker avoids request delays and also bypasses network protection.

Then, through a number of PowerShell scripts and auxiliary utilities, such as FoDHelper.exe, changes the system settings to bypass User Access Control (UAC) and adds Windows Defender antivirus to exceptions.

CoralRaider Infection Chain

The malware versions used include new features such as:

interception of RDP session data and recovery of expired Google account cookies (LummaC2 and Rhadamanthys);

advanced obfuscation and antianalysis mechanisms (LummaC2 and Rhadamanthys);

an expanded list of targeted applications, including password managers and authentication applications, which also threatens cryptocurrency wallets with two-factor authentication (CryptBot).

Apps targeted by the latest version of Cryptbot

According to the researchers, the CoralRaider group, presumably based in Vietnam, has been active since 2023 and previously used a Telegram bot to manage and exfiltrate data. While earlier attacks have more often focused on Asian and Southeast Asian countries, the latest operations cover a wider range of countries, including the United States, Nigeria, Pakistan, Ecuador, Egypt, the United Kingdom, Poland, the Philippines, Norway, Japan, Syria, and Turkey.