AllaKore RAT: Malware Targeting Mexican Companies

Mexican financial institutions are at the center of a new spear-phishing that delivers a modified version of an open-source remote access trojan, known as the AllaKore RAT.

The attackis attributed to an anonymous threat actor in Latin America, which has been active since 2021. The attacks target large companies in various sectors, including retail and banking, that have revenues of over $100 million.

Read more: WhiteSnake Stealer Malware is being transferred to Windows computers

The infection begins with a ZIP file containing an MSI installer, with the AllaKore RAT customized to steal banking credentials. Despite its simplicity, the AllaKore RAT is capable of recording keyboard and screen, uploading and downloading files, and gaining remote control. Enhanced functionality includes support for bank fraud, attacking Mexican banks, extracting clipboard content, and retrieving additional data.

The reported threat stems from the use of Starlink IP addresses in Mexico, which are linked to a campaign targeting Mexican entities. The links include instructions in Spanish to a modified RAT payload. These tools are used exclusively by large companies affiliated with the Mexican Social Security Institute (IMSS). The threat is aimed at financial gain and has been ongoing for more than two years. In addition, three vulnerabilities were detected in Bitcoin ATMs that allow full control and theft of users’ personal assets.

See more: Chameleon banking trojan: New variant bypasses biometric checks

The attacks exploit the software update mechanism and the ability to read QR codes. These problems were however addressed in October 2023 by a company in Switzerland.

Source: thehackernews.com