An advanced persistent threat (APT) group known as ScarCruft is now using malware to steal information off of Bluetooth devices.
Kaspersky Lab came across the malware during its analysis of ScarCruft’s recent activity. The security firm investigated a multistage binary infection scheme in which the group used an initial dropper that bypassed Windows User Account Control (UAC) to execute the next payload with higher privileges. With the help of public privilege escalation exploit code CVE-2018-8120, the malicious installer created and executed a downloader that connected to a command-and-control (C&C) server and downloaded the next payload: an image file that contained an appended malicious file hidden by steganography. This payload turned out to be ROKRAT, a backdoor known for stealing information.
The research also revealed ScarCruft’s interest in mobile devices. Specifically, Kaspersky Lab came across a piece of malware that used Windows Bluetooth application programming interfaces (APIs) to find information on connected Bluetooth devices. This data included the name, address and class of device as well as whether the device was connected, authenticated and/or remembered.
ScarCruft: An Experienced Threat Actor
ScarCruft has been running APT campaigns for some time now. Back in 2016, for instance, Kaspersky Lab announced that the group was to blame for Operation Daybreak, a campaign that leveraged spear phishing emails and a previously unknown zero-day exploit affecting Adobe Flash Player to conduct targeted attacks.
Approximately two years later, researchers at Palo Alto Networks discovered links between a previously unknown malware family called NOKKI and the threat actor, which also goes by the names Reaper, APT37 and Group123.
How to Defend Against Multistage Binary Infections
Security professionals can help defend against multistage binary infections by conducting phishing simulations to test their email security defenses against social engineering attacks.
Companies should also use a unified endpoint management (UEM) platform to monitor all IT assets — including mobile and internet of things (IoT) devices — for suspicious behavior.