According to cybersecurity researchers, a new APT, using the Crimson RAT , is attacking financial institutions in Indiato compromise their network devices and steal sensitive data.
Crimson RAT was first detected in 2016, when it targeted Indian diplomatic and military assets to carry out APT attacks. Since then, malicious actors have frequently used it to attack financial, healthcare, and aerospace sectors.
In this specific case, hackers used the Crimson RAT to target financial institutions in India by spreading spear-phishing emails.
Infection process by Crimson RAT
The email phishing campaign used emails containing malicious attachments, which were sent to the targeted organization in two different ways.
In the first case, the malicious email contained a link pointing to the PE file (executable file) containing two other ZIP files with an embedded document.
Once the payload is executed by the victim, it automatically checks the device, reports it to the C2 server, and downloads the ZIP payload based on the 32-bit or 64-bit version.
In the other case, the phishing email contains a DOC file that has a malicious macro embedded in it. After victims activate the macro, the RAT payload is executed and loads the clean Resume/CV file.
The Crimson RAT has the ability to extract sensitive data from the affected system and then transfer it via non-internet channels to its command-and-control (C&C) server.
The RAT continues to receive commands from the C&C server, performs the desired activities, and updates the results to the C2 server controlled by the attacker.
