An advanced persistent threat (APT) group known as ScarCruft is now using malware to steal information off of Bluetooth devices.

Kaspersky Lab came across the malware during its analysis of ScarCruft’s recent activity. The security firm investigated a multistage binary infection scheme in which the group used an initial dropper that bypassed Windows User Account Control (UAC) to execute the next payload with higher privileges. With the help of public privilege escalation exploit code CVE-2018-8120, the malicious installer created and executed a downloader that connected to a command-and-control (C&C) server and downloaded the next payload: an image file that contained an appended malicious file hidden by steganography. This payload turned out to be ROKRAT, a backdoor known for stealing information.

The research also revealed ScarCruft’s interest in mobile devices. Specifically, Kaspersky Lab came across a piece of malware that used Windows Bluetooth application programming interfaces (APIs) to find information on connected Bluetooth devices. This data included the name, address and class of device as well as whether the device was connected, authenticated and/or remembered.

ScarCruft: An Experienced Threat Actor

ScarCruft has been running APT campaigns for some time now. Back in 2016, for instance, Kaspersky Lab announced that the group was to blame for Operation Daybreak, a campaign that leveraged spear phishing emails and a previously unknown zero-day exploit affecting Adobe Flash Player to conduct targeted attacks.

Approximately two years later, researchers at Palo Alto Networks discovered links between a previously unknown malware family called NOKKI and the threat actor, which also goes by the names Reaper, APT37 and Group123.

How to Defend Against Multistage Binary Infections

Security professionals can help defend against multistage binary infections by conducting phishing simulations to test their email security defenses against social engineering attacks.

Companies should also use a unified endpoint management (UEM) platform to monitor all IT assets — including mobile and internet of things (IoT) devices — for suspicious behavior.

More from

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect EnglishChatGPT is a public tool based on a language model created by…

4 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read

Heads Up CEO! Cyber Risk Influences Company Credit Ratings

4 min read - More than ever, cybersecurity strategy is a core part of business strategy. For example, a company’s cyber risk can directly impact its credit rating. Credit rating agencies continuously strive to gain a better understanding of the risks that companies face. Today, those agencies increasingly incorporate cybersecurity into their credit assessments. This allows agencies to evaluate a company’s capacity to repay borrowed funds by factoring in the risk of cyberattacks. Getting Hacked Impacts Credit Scoring As per the Wall Street Journal…

4 min read