Active Campaign Targeting Middle East

An active campaign targeting Middle East and Africa through Middle Eastern geopoliticalthemed lures. In this campaign, the Earth Bogle threat actor uses public cloud storage services files.fm and failiem.lv to host and distribute the NjRAT malware on the web servers.

The NjRAT also known as Bladabindi, it is a Remote Access Trojan (RAT) malware and mostly used to gain unauthorized access and control over the infected machines such as stealing sensitive information, taking screenshots, getting a reverse shell, process, registry and file manipulation, uploading/downloading files, and performing other operations. The malware distributed via social media (Facebook and Discord appear to be favoured among these campaigns), file sharing (OneDrive), or a phishing email.

As observed, the Microsoft Cabinet (CAB) hides the malicious file under an audio file leveraging the geopolitical theme as a lure to entice Arabic speakers into opening it, the file contains a Virtual Basic Script (VBS) dropper masquerading as an image file fetches the malware and retrieves a PowerShell script responsible for injecting NjRAT into the compromised victim’s machine. The PowerShell script drops five files: two binaries, a VBS script, a PowerShell script, and a Windows batch script. Each file has specific functionality, the Payload_1: Process injector, the Payload_2: NjRAT, the gJhkEJvwBCHe.vbs: Executes rYFFCeKHlIT.bat, the rYFFCeKHlIT.bat: Executes KxFXQGVBtb.ps1, and the KxFXQGVBtb.ps1: Load Payload_1 and Payload_2 into the memory and inject NjRAT into the aspnet_compiler.exe via payload_1.