InfoSecBulletin Cybersecurity for mankind
ElizaRAT is malware that mainly targets Windows systems and acts as a remote access tool (RAT), allowing attackers to access infected devices without permission. This malware is often distributed through phishing campaigns or malicious downloads.
CheckPoint researchers found that APT36 (aka “Transparent Tribe”) is a Pakistan-based APT group, hackers are targeting high-profile Windows users with ElizaRAT.
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
ElizaRAT was initially identified in 2023, and since then, it has evolved significantly by incorporating advanced features.The infection chain of ElizaRAT begins with “phishing emails” containing malicious “CPL” files distributed via “Google Storage links.”
It establishes persistence by creating a “unique victim ID,” “setting up working directories in %appdata%,” and deploying secondary payloads like “ApoloStealer.”
The Checkpoint report states that this stealer component targets sensitive file types (“.doc,” “.pdf,” “.ppt,” “.xls”) and performs “systematic data exfiltration” via encrypted channels.
The malware employs sophisticated evasion techniques like:-
Time zone verification checks for India Standard Time.
Maintains reliability via various C2 communication methods.
Ranging from Slack API calls to Google Cloud Storage service account authentication using X.509 certificates.
Each campaign variant illustrates increasingly sophisticated capabilities while maintaining the core objective of persistent data theft from targeted “Indian institutions.” ‘ConnectX’ is a USB-targeting malware component within the ElizaRAT ecosystem.
click here to read full report.
