Vietnamese hacking group: a rising of information-stealing campaigns going global

Vietnamese hacking group: a rising of information-stealing campaigns going global

Speakers: Chetan Raghuprasad (Security Researcher, Cisco Talos); Joey Chen (Cisco Talos)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=prQD6-UkzQs

Overview

This talk, presented by Chetan Raghuprasad of Cisco Talos, delves into the rapidly evolving landscape of Vietnamese cybercrime, highlighting a significant shift from localized operations to a global threat profile. The research, conducted in collaboration with Joey Chen, uncovers the sophisticated tactics, techniques, and procedures (TTPs) employed by these threat actors, particularly focusing on information-stealing campaigns. The presentation introduces a newly identified group, Coral Rider, alongside other observed Vietnamese-origin campaigns leveraging bespoke and commodity malware.

The presentation underscores the growing sophistication of Vietnamese cybercriminals, who are no longer confined to small-scale regional attacks. Instead, they are demonstrating advanced capabilities in developing custom malware, employing intricate social engineering schemes, and utilizing evasion techniques to target victims worldwide for financial gain and data theft. This global expansion and increasing technical prowess necessitate a re-evaluation of the Vietnamese cyber threat, urging the international security community to recognize their growing impact and potential future trajectory as initial access brokers or advanced persistent threat (APT) actors.

Background

▶ Watch: Introduction: Vietnamese Cybercrime Going Global (0:00)

The Vietnamese cyber threat landscape has undergone a dramatic transformation in recent years, pivoting from primarily regional cybercrime activities to a more expansive, global footprint. This evolution has been particularly noticeable since the onset of the pandemic, during which threat actors have accelerated the development and deployment of sophisticated information stealers. Cisco Talos has observed a significant spike in the use of custom-developed malware, alongside commercially available tools, in campaigns targeting a broad array of victims. Notable information stealers like Sam Stealers, Baro Stealers, and Viet Credit have been rigorously employed, signaling a strategic enhancement of their offensive capabilities.

Beyond information theft, these groups have also dabbled in ransomware, albeit often leveraging less sophisticated encryptors. An example cited in the talk is the use of Yashmar ransomware, identified as the sixth iteration of the Chaos builder ransomware, indicating a willingness to diversify their revenue streams. Against this backdrop, Cisco Talos discovered a new group, dubbed Coral Rider, active since early 2023. This group, of Vietnamese origin, is primarily motivated by data theft and the hijacking of social media accounts for financial exploitation. While relatively new, Coral Rider has demonstrated advanced TTPs and a diverse malware arsenal, alongside other distinct Vietnamese-origin campaigns leveraging malware such as PXA stealer and LumaC2. The continuous evolution of their tactics, scripts, and malware, often involving modifications to existing tools with added functionalities, highlights their persistent adaptability in the cybercrime space.

Key Findings

▶ Watch: Coral Rider's Unique UAC Bypass Technique Explained (10:00)

The research illuminated several critical findings regarding the operational methodologies and malware arsenals of Vietnamese cybercrime groups:

• Emergence of Coral Rider: A newly identified, Vietnamese-origin threat group, active since 2023, primarily focused on data theft and social media account hijacking. Their targets span across India, China, South Africa, Bangladesh, Indonesia, Vietnam, and Ukraine.
• Sophisticated TTPs: Coral Rider heavily relies on social engineering for initial access, coupled with advanced data exfiltration techniques and the use of dead dropping mechanisms. They also employ various commodity loaders to deliver their payloads.
• Diverse Malware Arsenal: The group utilizes a mix of established and novel information stealers. Their observed arsenal includes NetSupport RAT, Async RAT, LumaC2, and Radamant. Crucially, the talk introduced two new, customized variants: the Rotbot loader and the Xline stealer, which represent significant contributions to their capabilities.
• Advanced Evasion and UAC Bypass: A standout technical finding was Coral Rider's sophisticated User Account Control (UAC) bypass technique that abuses the fodhelper.exe Windows helper program by manipulating specific COM object registry keys, specifically the cover registry key. This allowed for the execution of malicious scripts with elevated privileges, evading user prompts.
• Telegram as C2 and Exfiltration: Both Coral Rider and the PXA stealer campaign extensively leverage Telegram bots for command and control (C2) communications and efficient data exfiltration, utilizing Telegram APIs to send stolen documents, photos, and messages.
• Specific Targeting of Data Types: The campaigns are designed to steal a wide array of sensitive information, including browser credentials, financial data, cryptocurrency wallet information, cookies, credit card details, and credentials from social media (Facebook, YouTube, Instagram, TikTok), messaging apps (Telegram Desktop, Discord), password managers, authenticator applications, VPN clients, and FTP clients.
• Attribution to Vietnam: Attribution was achieved through a combination of unique artifacts:
• PDB strings containing Vietnamese names.
• Hardcoded Vietnamese words within binaries, often used to translate exfiltrated fields.
• Correlation of threat actor underground activities with observed campaign TTPs.
• Analysis of attacker Telegram bot server environments, revealing debugging screenshots, Windows hardware IDs, and an IP address traced to Hanoi, Vietnam.
• Discovery of OneDrive folders whose names matched the identified PDB strings.
• Observations of actors selling stolen credentials and automated tools in Vietnamese-centric underground forums and Telegram channels.
• Evolutionary Trajectory: The talk emphasized the continuous evolution of these actors, noting their rapid adoption of new scripts, malware modifications, and early exploration of AI/LLM models to enhance their techniques, hinting at a potential future role as initial access brokers.

Technical Deep Dive

▶ Watch: Xline Stealer: Comprehensive Credential & Social Media Theft (11:36)

The presentation provided a granular look into two distinct campaigns, outlining their attack chains, unique TTPs, and the specific malware employed.

Case Study 1: Coral Rider Campaign

Coral Rider primarily targeted victims in Asia and Southeast Asian countries, employing a multi-stage attack chain with notable sophistication.

Initial Access and Execution Chain:

The first intrusion began with LNK files embedded with PowerShell commands. These commands connected to a download server, retrieving malicious HDA files. These HDA files, loaded on the victim's system, contained VBScript and further PowerShell commands. The PowerShell scripts operated in stages:

1. First-stage PowerShell script: Decrypted and executed the second stage.
2. Second-stage PowerShell script: Decrypted and executed the third stage.
3. Third-stage PowerShell script: Exhibited advanced anti-VM and anti-analysis techniques, along with a sophisticated UAC bypass technique.
4. Fourth-stage PowerShell script (Downloader): Connected to a download server to fetch the Rotbot loader.

UAC Bypass Technique (Fodhelper.exe Abuse):

A particularly ingenious UAC bypass was observed. The threat actors abused a COM object registry key known as the cover registry key. This technique leverages the legitimate Windows helper program fodhelper.exe, which manages features in Windows settings. fodhelper.exe relies on the MS settings registry key, which in turn leverages the cover registry key. Coral Rider created a custom ProgID (COM object registry key) named OMG and configured it to the cover registry key, embedding their fourth-stage downloader PowerShell script within it. When fodhelper.exe was executed, it inadvertently triggered the MS settings key, leading to the cover key, which then executed the embedded malicious PowerShell script, bypassing UAC prompts.

Payloads and Capabilities:

• Rotbot Loader: This intermediate payload was downloaded from Google Docs, where an XML file containing a Telegram bot ID and token was hosted. Analysis revealed Rotbot to be a customized variant of the Kusarat client. Its functionalities included performing reconnaissance, modifying internet proxy settings, and crucially, loading and running the Xline stealer binary, which was embedded within its resource section.
• Xline Stealer: This extensive script performed initial anti-VM and antivirus checks. Its core capabilities included:
• Screenshot capture.
• Credential and financial data theft from a wide range of browsers: Chrome, Microsoft Edge, Brave, Coco, and Firefox.
• Hijacking and stealing data from social media accounts (Facebook, YouTube, Instagram, TikTok) and messaging applications (Telegram Desktop, Discord).
• Exfiltration via a Telegram C2 bot, using Telegram APIs like send document, send photo, and send messages.
• Other Payloads (Second Intrusion variant): In a second intrusion within the same campaign, CDN edge devices were used to host malicious HDA files. The payloads varied to include:
• Crybot: A well-known info stealer (active since 2019) targeting browser data, cryptocurrencies, valid cookies, and credit card details. Some samples used VMProtect and also targeted password manager databases and authenticator applications.
• LumaC2: Another established stealer, observed using custom obfuscation algorithms and symmetric encryption for its C2 domains. It attempted to connect to approximately nine different C2 servers and included functionality to steal Discord credentials.
• Radamant: Executed via a two-stage Python executable loader. The first stage used a binary replacer script to decode the second stage. The second stage leveraged Windows APIs to allocate memory and inject the Radamant stealer into targeted processes, such as dialer.exe and openwith.exe, after unpacking.

Case Study 2: PXA Stealer Campaign

This campaign primarily targeted victims in Europe and Asia, with a focus on stealing cryptocurrency wallets, password manager data, VPN client credentials, FTP client information, gaming application data, and messenger application credentials.

Attack Chain:

The initial access vector was phishing emails containing a ZIP attachment. This archive dropped a batch script and a Rust loader. Human intervention was required, as the victim had to manually execute the Rust loader, which masqueraded as a legitimate executable. Upon execution, the Rust loader ran the batch script, which performed three key activities:

1. Downloaded a portable Python executable named semantics from a hosting site.
2. Downloaded and executed another Python script designed to evade antivirus detections.
3. Downloaded and executed the PXA bot stealer script, intended to connect victims to a botnet server.

PXA Stealer Functionalities:

The PXA stealer script was extensive, featuring multiple capabilities:

• Evasion Tactics: Utilized taskkill commands to terminate a wide range of processes, including endpoint detection software, network capture tools (e.g., Wireshark), VPN clients, cryptocurrency wallet applications, browser instances, and instant messaging applications during its initial execution phase.
• Harvest Functions: Targeted browser master keys (using decryption functions), login credentials, credit card information, autofill data, Discord tokens, and Facebook data.
• Exfiltration: Collected all stolen data, renamed the files, archived them, and then exfiltrated the archive to a Telegram bot. Post-exfiltration, it performed cleanup activities by deleting all created archives.

Demo / Proof of Concept

▶ Watch: Telegram Bot Screenshots and Hanoi IP Confirm Attribution (22:00)

While the talk provided an in-depth analysis of the observed attack chains, malware capabilities, and attribution techniques, it did not feature a live demonstration or proof-of-concept during the presentation. The speakers focused on sharing their investigative findings and technical analysis based on collected samples and observed campaign activities.

Defensive Implications

▶ Watch: Future: Vietnamese Actors as IABs, Leveraging AI (26:00)

The insights gleaned from these Vietnamese cybercrime campaigns offer crucial guidance for defenders seeking to bolster their security postures against evolving threats.

• Strengthen Initial Access Defenses:
• User Awareness Training: Continuous education on social engineering tactics, phishing emails, and the dangers of executing suspicious LNK files or HDA attachments.
• Email Filtering: Implement robust email gateway solutions to detect and block malicious attachments (ZIP, LNK, HDA) and phishing attempts.
• Endpoint Detection & Response (EDR): Configure EDR solutions to monitor and alert on suspicious execution of PowerShell scripts, HDA files, and unusual process chains originating from user-downloaded content.
• Detect Execution and Persistence Techniques:
• UAC Bypass Monitoring: Pay close attention to fodhelper.exe execution, especially when it's part of an unusual process tree or associated with modifications to COM object registry keys like the cover key. Monitor for the creation of new ProgIDs in the registry.
• PowerShell Script Analysis: Implement advanced PowerShell logging and analysis to detect obfuscated or malicious scripts, particularly those performing decryption, anti-VM checks, or connecting to external download servers.
• Anti-VM/AV Evasion: Deploy EDR solutions capable of identifying and blocking common anti-VM and anti-analysis techniques, as well as taskkill commands targeting security products or legitimate applications.
• Patch Management: Ensure all operating systems, browsers (Chrome, Edge, Firefox, Brave), and applications (Telegram Desktop, Discord, VPN clients, FTP clients) are regularly patched to mitigate vulnerabilities exploited by stealers.
• Prevent Data Exfiltration:
• Network Monitoring: Implement network traffic analysis to detect unusual outbound connections, especially to Telegram APIs or known C2 domains. Look for large data transfers over non-standard ports or protocols.
• Data Loss Prevention (DLP): Deploy DLP solutions to prevent sensitive information (credentials, financial data, personal files) from being exfiltrated from the network.
• C2 Blocking: Maintain updated threat intelligence feeds to block known C2 domains and IP addresses associated with these campaigns.
• General Security Hygiene:
• Strong Authentication: Enforce multi-factor authentication (MFA) for all critical accounts, especially social media, financial, and business accounts, to mitigate the impact of stolen credentials.
• Least Privilege: Implement the principle of least privilege for user accounts and applications to limit the potential damage from successful intrusions.
• Antivirus/EDR: Utilize and regularly update robust antivirus and EDR solutions across all endpoints.
• Threat Intelligence Integration: Actively consume and integrate threat intelligence specifically on Vietnamese threat actors, their evolving TTPs, and newly identified malware (Rotbot, Xline, PXA, customized Crybot, LumaC2, Radamant variants).
• Monitor for AI/LLM Exploitation: Given the early signs of these groups exploring AI/LLM models, security teams should stay vigilant for new attack vectors leveraging these technologies, such as enhanced social engineering or automated malware generation.

Key Takeaways

• Vietnamese cybercrime groups are rapidly evolving from regionally focused operations to a significant, global threat, demonstrating increasing sophistication in their TTPs and malware development.
• Coral Rider is a new, active information-stealing group of Vietnamese origin, leveraging a mix of bespoke malware (e.g., Rotbot loader, Xline stealer) and commodity tools (e.g., Crybot, LumaC2, Radamant).
• Sophisticated evasion techniques, including a novel UAC bypass abusing fodhelper.exe and specific registry keys, highlight their technical prowess in bypassing security controls.
• Telegram bots serve as a primary and highly effective channel for both command and control (C2) and exfiltration of stolen data, ranging from browser credentials and financial information to social media and messaging app data.
• Attribution efforts successfully linked these campaigns to Vietnamese actors through unique artifacts like PDB strings, hardcoded Vietnamese language in binaries, underground forum activities, and analysis of their Telegram operational environment.
• The continued evolution of these actors, including their early exploration of AI/LLM models and active participation in underground markets, suggests a future trajectory where they may emerge as initial access brokers, selling stolen credentials to other cybercrime groups or ransomware operators.

About the Speaker(s)

Chetan Raghuprasad is a Security Researcher at Cisco Talos, a leading threat intelligence organization. Based in Singapore, Chetan's research focuses on uncovering and analyzing emerging cyber threats, particularly those originating from various geopolitical regions. His work contributes to a deeper understanding of threat actor methodologies and the development of robust defensive strategies.

Joey Chen is also a Security Researcher at Cisco Talos, based in Taiwan. While Chetan presented this specific talk, Joey Chen was a key collaborator in the underlying research discussed, and presented on another related topic at the same conference. His expertise similarly contributes to Cisco Talos's comprehensive threat intelligence efforts.