Home > News > Sugargh0st RAT: China’s Cyber Strike! 🌐🎯

Sugargh0st RAT: China’s Cyber Strike! 🌐🎯

chinese hackers using sugargh0st rat to target south korea and uzbekistan feature

Chinese Hackers Target South Korea and Uzbekistan with Sugargh0st Rat

A new cyber espionage campaign has been discovered that leverages a customized variant of Gh0st RAT (aka Farfli) called SugarGh0st RAT. The campaign is attributed to a suspected Chinese-speaking threat actor that targets the Uzbekistan Ministry of Foreign Affairs and South Korean users. The campaign began no later than August 2023 and leverages two different infection sequences to deliver the malware.

The attack commences with a phishing email bearing decoy documents. When the victim opens the decoy documents, it activates a multi-stage process that leads to the deployment of SugarGh0st RAT. The decoy documents are incorporated within a heavily obfuscated JavaScript dropper that's contained within a Windows Shortcut file embedded in the RAR archive email attachment. The JavaScript decodes and drops the embedded files into the %TEMP% folder, including a batch script, a customized DLL loader, an encrypted SugarGh0st payload, and a decoy document. The decoy document is then displayed to the victim, while, in the background, the batch script runs the DLL loader, which, in turn, side-loads a copied version of a legitimate Windows executable called rundll32.exe to decrypt and launch the SugarGh0st payload.

A second variant of the attack also begins with a RAR archive containing a malicious Windows Shortcut file that masquerades as a lure. The JavaScript leverages DynamicWrapperX to run shellcode that launches SugarGh0st.

SugarGh0st, a 32-bit dynamic-link library (DLL) written in C++, establishes contact with a hard-coded command-and-control (C2) domain, allowing it to transmit system metadata to the server, launch a reverse shell, and run arbitrary commands. It can also enumerate and terminate processes, take screenshots, perform file operations, and even clear the machine's event logs in an attempt to cover its tracks and evade detection.

The campaign's links to China stem from Gh0st RAT's Chinese origins and the fact that the fully functional backdoor has been widely adopted by Chinese threat actors over the years, in part driven by the release of its source code in 2008. Another smoking gun evidence is the use of Chinese names in the “last modified by” field in the metadata of the decoy files.

The development comes as Chinese state-sponsored groups have also increasingly targeted Taiwan in the last six months, with the attackers repurposing residential routers to mask their intrusions.

image Β© 2024. all rights reserved.

Frequently Asked Questions

What is the SugarGh0st RAT and how does it operate?

SugarGh0st RAT is a remote access trojan used by Chinese-speaking threat actors to gain unauthorized access to targeted systems. The malware is typically delivered via spear-phishing emails or malicious attachments. Once installed, the RAT allows hackers to remotely control the compromised system, steal sensitive data, and execute additional malicious activities.

What are the primary objectives of the hackers using SugarGh0st RAT in cyberespionage?

The primary objective of the hackers using SugarGh0st RAT is to conduct cyber espionage activities against targeted countries. The malware has been used to target the Uzbekistan Ministry of Foreign Affairs and South Korean users. The attackers aim to steal sensitive information, gain access to critical infrastructure, and monitor the activities of their targets.

How do the tactics of Chinese hackers targeting South Korea and Uzbekistan differ?

The tactics of Chinese hackers targeting South Korea and Uzbekistan differ depending on the specific campaign and target. However, in general, the attackers use similar tactics, techniques, and procedures (TTPs) to deliver the SugarGh0st RAT malware. They use spear-phishing emails, social engineering, and exploit kits to deliver the malware to their targets.

What measures can organizations take to protect against threats like SugarGh0st RAT?

Organizations can take several measures to protect against threats like SugarGh0st RAT. These include:
Educating employees on how to identify and report suspicious emails and attachments
Implementing strong email security and anti-phishing measures
Keeping software and systems up-to-date with the latest security patches
Deploying endpoint protection solutions that can detect and block malware
Conducting regular security assessments and penetration testing to identify vulnerabilities

Have there been any significant breaches attributed to the SugarGh0st RAT campaign?

There have been reports of data breaches and cyber espionage activities attributed to the SugarGh0st RAT campaign. However, the full extent of the damage caused by the malware is not yet known.

What is the international response to the discovery of SugarGh0st RAT cyberattacks?

The international response to the discovery of SugarGh0st RAT cyberattacks has been mixed. Some countries have condemned the attacks and called for increased cooperation and information sharing to combat cyber threats. Others have been more cautious and have not publicly attributed the attacks to specific threat actors.


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.