The Lazarus Group, a renowned state-sponsored threat actor backed by North Korea, continues to pose a significant cybersecurity threat. In recent findings, security analysts at Cisco Talos have confirmed that the Lazarus Group is actively exploiting the ManageEngine flaw (CVE-2022-47966) to deploy the MagicRAT malware. Additionally, in Europe, the Lazarus Group targeted an internet backbone infrastructure provider, deploying the QuiterAT malware. This article aims to delve into the intricacies of these attacks, shed light on QuiterAT’s characteristics and connections to MagicRAT, and analyze the significance of QuiterAT’s emergence.
Lazarus Group Exploiting ManageEngine Flaw
The cybersecurity community was alerted when Cisco Talos shared their report on the Lazarus Group’s exploitation of the ManageEngine flaw. The flaw (CVE-2022-47966) allows the threat actor to gain unauthorized access and deploy the MagicRAT malware. This state-sponsored group utilizes advanced techniques to infiltrate targeted systems and exfiltrate sensitive information.
Attack on Internet Backbone Infrastructure in Europe
Adding to their aggressive activities in Europe, the Lazarus Group launched an attack on an internet backbone infrastructure provider in early 2023. Their primary objective was to deploy the QuiteRAT malware. This attack raises concerns about the potential disruption of critical internet services and highlights the audacity of the Lazarus Group.
Overview of QuiteRAT
QuiteRAT, an evolution of the notorious MagicRAT, is a Remote Access Trojan (RAT) that incorporates Qt libraries without a Graphical User Interface (GUI). This lightweight malware shrinks down to merely 4-5MB, in contrast to the bulkier 18MB MagicRAT, by utilizing fewer Qt libraries. This reduction in size allows the Lazarus Group to deploy it more discreetly and evade detection.
Given the similarities in traits, QuiteRAT is considered to be closely connected to the MagicRAT family. Both malware variants share their Qt framework roots, command execution capabilities, string obfuscation techniques, and sleep functionality. These common characteristics strongly indicate QuiteRAT’s roots in MagicRAT.
Networking Settings and Encryption in QuiteRAT
To ensure the security of their Command-and-Control (C2) communications, QuiteRAT leverages XOR (0x78) and base64 encoding techniques to encode strings containing C2 URLs and extended URI parameters. This approach not only obfuscates the malicious traffic but also obstructs analysis and detection by security solutions.
Latest Version and Evolution of MagicRAT
The most recent version of MagicRAT was identified in the wild in April 2022. Since then, the Lazarus Group has been evolving their tactics with the emergence of QuiteRAT. This new iteration represents a strategic shift towards a smaller Qt-based approach, allowing the threat actors to maximize their operational efficiency and increase the chances of successful infiltration.
Significance of QuiteRAT’s Emergence
The emergence of QuiteRAT in May 2023 signifies the Lazarus Group’s adaptive nature and their commitment to staying one step ahead of cybersecurity defenses. By utilizing a lightweight RAT with reduced dependencies on Qt libraries, the group aims to enhance their stealth and minimize the footprint of their malicious activities. This highlights the need for constant vigilance and strengthened defenses against state-sponsored threat actors.
The Lazarus Group, with backing from North Korea, remains a dangerous adversary in the world of cybersecurity. Their recent activities, including the exploitation of the ManageEngine flaw and attacks on internet backbone infrastructure, demonstrate their ongoing threat to critical entities across Europe and the United States. The emergence of QuiteRAT, an evolution of MagicRAT, signifies the group’s adaptability and determination to refine their tactics. It is crucial for organizations to maintain robust cybersecurity measures, keep their systems up to date, and engage in continuous monitoring to detect and mitigate the risks posed by state-sponsored threat actors like the Lazarus Group.