In a concerning development, Mexican financial institutions have become the primary targets of a sophisticated spear-phishing campaign. Threat actors, believed to be financially motivated and based in Latin America, leverage a modified version of the AllaKore RAT to carry out their malicious activities. This ongoing campaign, which has been active since at least 2021, highlights the gravity of the cyber threats faced by the financial sector in Mexico.
Duration and Targeting
Over the past several months, this spear-phishing campaign has specifically focused on large companies operating across various sectors within Mexico. It exclusively targets entities with gross revenues surpassing $100 million, indicating the threat actor’s intention to maximize financial gains. This deliberate targeting strategy serves as a stark reminder of the importance of enhanced cybersecurity measures for organizations operating in Mexico.
Delivery and Payload
The infection chain begins with the delivery of a compressed ZIP file that contains an MSI installer. Once executed, this installer places a .NET downloader on the victim’s system. The downloader has two main functions: confirming the victim’s geolocation as Mexican and fetching the modified AllaKore RAT. The threat actors have extensively customized this altered version of the remote access trojan to maximize its effectiveness in conducting financial fraud.
Functionality of the AllaKore RAT
The AllaKore RAT boasts a wide range of capabilities that enable threat actors to conduct various malicious activities unhindered. Keylogging functionality allows them to record sensitive keystrokes, potentially capturing critical banking credentials and unique authentication information. Additionally, the RAT can perform screen capturing, file upload/download, and remote control, providing complete access to the victim’s machine.
The threat actors have further augmented the malware by integrating functions specifically designed for banking fraud. This modified RAT not only targets Mexican banks but also crypto trading platforms, making it a significant threat to the financial ecosystem. Furthermore, the threat actors can initiate a reverse shell, extract clipboard content, and fetch and execute additional payloads, adding to the versatility and potency of their attack techniques.
Links to Latin America
Evidence linking the threat actors to Latin America is apparent in their tactics, techniques, and procedures. The use of Mexico Starlink IPs to carry out the attacks suggests a connection to the region. Furthermore, the modified RAT payload includes instructions in Spanish, reinforcing the likelihood of a Latin America-based threat actor group perpetrating these attacks.
IMSS Department Lures
The lures employed in this spear-phishing campaign specifically target companies reporting directly to the Mexican Social Security Institute (IMSS) department. By tailoring the phishing emails to appear authentic and relevant to the IMSS, cybercriminals manipulate victims into falling for their malicious schemes. This strategic targeting highlights the threat actors’ intimate knowledge of the Mexican financial ecosystem.
Persistent Targeting
Disturbingly, this ongoing campaign reveals that the threat actors have pursued financial gain by persistently targeting Mexican entities for over two years. The extended duration of their activities demonstrates their determination and sophistication. It serves as a crucial reminder that the threat landscape continues to evolve, necessitating a proactive approach to cybersecurity to effectively mitigate such risks.
The spear-phishing campaign targeting Mexican financial institutions with a modified version of the AllaKore RAT poses a significant threat to the integrity and security of the country’s financial sector. As the threat actors continue to refine their tactics and evolve their malware, it is imperative that organizations increase their awareness and strengthen their cybersecurity defenses. Implementing robust detection systems, providing employee training, and proactively hunting threats can help mitigate the risks and safeguard the financial institutions that form the backbone of Mexico’s economy. Only through collective vigilance and collaboration can we effectively combat and neutralize these ongoing cyber threats.