May 14, 2019 By David Bisson 2 min read

An advanced persistent threat (APT) group known as ScarCruft is now using malware to steal information off of Bluetooth devices.

Kaspersky Lab came across the malware during its analysis of ScarCruft’s recent activity. The security firm investigated a multistage binary infection scheme in which the group used an initial dropper that bypassed Windows User Account Control (UAC) to execute the next payload with higher privileges. With the help of public privilege escalation exploit code CVE-2018-8120, the malicious installer created and executed a downloader that connected to a command-and-control (C&C) server and downloaded the next payload: an image file that contained an appended malicious file hidden by steganography. This payload turned out to be ROKRAT, a backdoor known for stealing information.

The research also revealed ScarCruft’s interest in mobile devices. Specifically, Kaspersky Lab came across a piece of malware that used Windows Bluetooth application programming interfaces (APIs) to find information on connected Bluetooth devices. This data included the name, address and class of device as well as whether the device was connected, authenticated and/or remembered.

ScarCruft: An Experienced Threat Actor

ScarCruft has been running APT campaigns for some time now. Back in 2016, for instance, Kaspersky Lab announced that the group was to blame for Operation Daybreak, a campaign that leveraged spear phishing emails and a previously unknown zero-day exploit affecting Adobe Flash Player to conduct targeted attacks.

Approximately two years later, researchers at Palo Alto Networks discovered links between a previously unknown malware family called NOKKI and the threat actor, which also goes by the names Reaper, APT37 and Group123.

How to Defend Against Multistage Binary Infections

Security professionals can help defend against multistage binary infections by conducting phishing simulations to test their email security defenses against social engineering attacks.

Companies should also use a unified endpoint management (UEM) platform to monitor all IT assets — including mobile and internet of things (IoT) devices — for suspicious behavior.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today