An unknown threat group has been linked to multiple attacks on Azerbaijan and Israel in an effort to snatch vital information.
NSFOCUS discovered the attack operation on August 1, 2024, which involved using targeted spear-phishing emails against diplomats from Azerbaijan and Israel. The campaign is being monitored under the alias Actor240524.
“Actor240524 is capable of extracting confidential data and altering file content, employing various measures to prevent the exposure of attack strategies and methods,” the cybersecurity firm stated in a report published recently.
The attack sequence kicks off with phishing emails containing Microsoft Word attachments that, when opened, prompt the recipients to “Activate Content” and execute a malicious macro initiating an intermediate loader named ABCloader (“MicrosoftWordUpdater.log”).
Subsequently, ABCloader functions as a bridge to decrypt and load a DLL malware named ABCsync (“synchronize.dll”), which then establishes communication with a remote server (“185.23.253[.]143”) to fetch and execute commands.
“Its primary role is to identify the operational environment, decrypt the software, and load the subsequent DLL (ABCsync),” according to NSFOCUS. “It additionally employs various methods to evade sandbox and analysis tools for environmental detection.”
ABCsync’s functionalities include executing remote shells, operating commands via cmd.exe, and extracting system data and other information.
Both ABCloader and ABCsync utilize techniques like encrypting strings to disguise critical file paths, file names, keys, error messages, and command-and-control (C2) locations. They also conduct multiple validations to ascertain if the processes are being debugged or run in a virtual machine or sandbox by checking the display resolution.
Another vital step taken by Actor240524 is to verify if the number of processes running in the compromised system is below 200. If so, the malicious process terminates.
Moreover, ABCloader is programmed to introduce a similar loader named “synchronize.exe” and a DLL file known as “vcruntime190.dll” or “vcruntime220.dll,” which can establish persistence on the system.
“Azerbaijan and Israel share a strong economic and political relationship,” highlighted NSFOCUS. “The current operation by Actor240524 seems to target the collaborative endeavors of both nations by launching phishing attempts on diplomatic staff from both sides.”
About Author
