After 2 years under the radars, Ratsnif emerges in OceanLotus ops

Security experts spotted a news wave of attacks carried out by the OceanLotus APT group that involved the new Ratsnif Trojan.

Experts at the security firm Cylance detected a new RAT dubbed Ratsnif that was used in cyber espionage operations conducted by the OceanLotus APT group.

The OceanLotus APT group, also known as APT32 or Cobalt Kitty, is state-sponsored group that has been active since at least 2013.

The hackers targeted organizations across multiple industries and have also hit foreign governments, dissidents, and journalists.

Since at least 2014, experts at FireEye have observed APT32 targeting foreign corporations with an interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The APT32 also targeted peripheral network security and technology infrastructure corporations, and security firms that may have connections with foreign investors.

Due to the type of targets, OceanLotus is believed to be a Vietnam-linked cyber espionage group.

Back to nowadays, the Ratsnif RAT was improved with new capabilities that allow the threat to modify web pages and SSL hijacking.

“Surfacing during the latter half of 2018 and wrapped in a bespoke OceanLotus shellcode loader, this sample was first reported in a blog from Macnica Networks.” reads the analysis published by Cylance. “Compared to the 2016 variants this sample introduces a configuration file and does not rely on C2 for operation. It also adds new features in the form of HTTP injection, protocol parsing, and SSL hijacking.”

In previous attacks, OceanLotus hackers used both custom malware with commercially-available tools, like Cobalt Strike.

The experts analyzed four different samples of the Ratsnif RAT, three dated back 2016, and the fourth created in H2 2018.

The analysis revealed the evolution of the malware, from a debug build to a stable release that implements the following features:

• C2 over HTTP
• Packet sniffing
• ARP poisoning
• DNS spoofing
• HTTP redirection
• Remote shell

While 2 out of 3 of 2016 samples appear to be version under development and testing, the third one compiled September 13, 2016, was “one of the earlier Ratsnifs to be deployed by OceanLotus in-the-wild.”

Once installed on the target machine, Ratsnif creates a run once mutex named “onceinstance”, initialises Winsock version 2.2 and sends back to the C2 collected system information (i.e. username, computer name, workstation configuration, Windows system directory, and network adapter information).

The samples analyzed by the experts have hardcoded one or more C2 domains, but only one seemed to have been active.

The 2018 variant analyzed by Cylance leverages a different piece of malware deployed on the victim host for communications.

“Compared to the 2016 variants this sample introduces a configuration file and does not rely on C2 for operation. It also adds new features in the form of HTTP injection, protocol parsing, and SSL hijacking.” continues the analysis.

Experts discovered that it is possible to decrypt the traffic by using version 3.11 of the wolfSSL library, formerly known as CyaSSL.

The malware doesn’t protect the configuration file, it is a text file encoded in Base64 with a parameter on its own line.

The expert also found a bug in the Ratsnif RAT that caused a memory read violation when parsing the “dwn_ip” parameter if the value is present in the configuration.

Another difference between 2016 variants of Ratsnif and the 2018 one is that the former samples stored all packets to a PCAP file, the latter uses multiple sniffer classes for harvesting sensitive information from packets.

In this way, the malware drastically reduces the amount of data the attacker has to collect, exfiltrate and process.

“Ratsnif is an intriguing discovery considering the length of time it has remained undetected, likely due to limited deployment. It offers a rare glimpse of over two years of feature development, allowing us to observe how threat actors tailor tooling to their nefarious purposes.” concludes the experts. “While all samples borrow heavily from open-source code/snippets, overall development quality is deemed to be poor. Simply put, Ratsnif does not meet the usual high standards observed in OceanLotus malware.”

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – OceanLotus, Ratsnif)

[adrotate banner=”5″]

[adrotate banner=”13″]