May 14, 2019 By David Bisson 2 min read

An advanced persistent threat (APT) group known as ScarCruft is now using malware to steal information off of Bluetooth devices.

Kaspersky Lab came across the malware during its analysis of ScarCruft’s recent activity. The security firm investigated a multistage binary infection scheme in which the group used an initial dropper that bypassed Windows User Account Control (UAC) to execute the next payload with higher privileges. With the help of public privilege escalation exploit code CVE-2018-8120, the malicious installer created and executed a downloader that connected to a command-and-control (C&C) server and downloaded the next payload: an image file that contained an appended malicious file hidden by steganography. This payload turned out to be ROKRAT, a backdoor known for stealing information.

The research also revealed ScarCruft’s interest in mobile devices. Specifically, Kaspersky Lab came across a piece of malware that used Windows Bluetooth application programming interfaces (APIs) to find information on connected Bluetooth devices. This data included the name, address and class of device as well as whether the device was connected, authenticated and/or remembered.

ScarCruft: An Experienced Threat Actor

ScarCruft has been running APT campaigns for some time now. Back in 2016, for instance, Kaspersky Lab announced that the group was to blame for Operation Daybreak, a campaign that leveraged spear phishing emails and a previously unknown zero-day exploit affecting Adobe Flash Player to conduct targeted attacks.

Approximately two years later, researchers at Palo Alto Networks discovered links between a previously unknown malware family called NOKKI and the threat actor, which also goes by the names Reaper, APT37 and Group123.

How to Defend Against Multistage Binary Infections

Security professionals can help defend against multistage binary infections by conducting phishing simulations to test their email security defenses against social engineering attacks.

Companies should also use a unified endpoint management (UEM) platform to monitor all IT assets — including mobile and internet of things (IoT) devices — for suspicious behavior.

More from

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Cybersecurity Awareness Month: 5 new AI skills cyber pros need

4 min read - The rapid integration of artificial intelligence (AI) across industries, including cybersecurity, has sparked a sense of urgency among professionals. As organizations increasingly adopt AI tools to bolster security defenses, cyber professionals now face a pivotal question: What new skills do I need to stay relevant?October is Cybersecurity Awareness Month, which makes it the perfect time to address this pressing issue. With AI transforming threat detection, prevention and response, what better moment to explore the essential skills professionals might require?Whether you're…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today