Trend Micro details an active Earth Bogle campaign targeting the Middle East and North Africa that uses geopolitical-themed lures to distribute NjRAT (Bladabindi). Attackers host payloads on public cloud storage and compromised web servers, distributing them via social media, file sharing, and phishing to victims in the region. #EarthBogle #NjRAT #Bladabindi #TBZMilitia #gpla.gov.ly
Keypoints
- The Earth Bogle campaign leverages Middle Eastern geopolitical themes to lure victims in the MENA region.
- Malware is hosted on public cloud services (files.fm, failiem.lv) and delivered through compromised web servers.
- A CAB file masquerades as a sensitive audio file and contains an obfuscated VBS dropper that fetches additional payloads.
- The second stage uses PowerShell scripts to inject NjRAT into the victim’s system, via a deobfuscated dropper chain.
-
MITRE Techniques
- [T1566.001] Phishing – The distribution mechanism could be via social media (Facebook and Discord appear to be favored among these campaigns), file sharing (OneDrive), or a phishing email. ‘The distribution mechanism could be via social media (Facebook and Discord appear to be favored among these campaigns), file sharing (OneDrive), or a phishing email.’
- [T1204.002] User Execution – The CAB file is masqueraded as a sensitive audio file and opened by the user to trigger infection. ‘The malicious CAB file contains an obfuscated VBS (Virtual Basic Script) dropper responsible for delivering the next stage of the attack.’
- [T1105] Ingress Tool Transfer – The dropper fetches the malware from a compromised or spoofed host. ‘When downloaded, the obfuscated VBS script runs to fetch the malware from a compromised or spoofed host.’
- [T1059.005] VBScript – The initial CAB dropper uses a VBScript to stage the attack. ‘The CAB file contains an obfuscated VBS script that functions as the agent…’
- [T1059.001] PowerShell – The second stage payload is a PowerShell script responsible for injecting NjRAT. ‘KxFXQGVBtb.ps1: Load Payload_1 and Payload_2 into the memory and inject NjRAT into the aspnet_compiler.exe via payload_1’
- [T1027] Obfuscated/Compressed Files and Information – The VBS and PowerShell payloads are obfuscated. ‘the second stage dropper (SHA256: 78ac9da3…) is an obfuscated PowerShell script’
- [T1055] Process Injection – NjRAT is injected into a legitimate process via a process injector. ‘NjRAT into the aspnet_compiler.exe via the process injector.’
- [T1547.001] Boot or Logon Initialization Scripts (Startup Folder) – Persistence by adding startup-related folders and keys. ‘adding the directory C:ProgramDataWindowsHost to the “User Shell” folders and “Shell” folders to the startup keys accordingly.’
Indicators of Compromise
- [Hash] SHA256 – a7e2b399b9f0be7e61977b51f6d285f8d53bd4b92d6e11f74660791960b813da, 4985b6e286020de70f0b74d457c7e387463ea711ec21634e35bc46707dfe4c9b, and 2 more hashes
- [Hash] SHA256 – 6560ef1253f239a398cc5ab237271bddd35b4aa18078ad253fd7964e154a2580, 78ac9da347d13a9cf07d661cdcd10cb2ca1b11198e4618eb263aec84be32e9c8
- [Domain] gpla.gov.ly – Domain associated with Libyan Army and used in the campaign infrastructure (registered in 2019). ‘The domain delivering the malicious PowerShell script is an infected or spoofed host with documented affiliations with the Libyan Army… gpla[.]gov[.]ly shows it was registered in 2019.’
- [File name] gJhkEJvwBCHe.vbs, rYFFCeKHlIT.bat – Components of the second-stage dropper used to execute PowerShell payloads. ‘gJhkEJvwBCHe.vbs: Executes rYFFCeKHlIT.bat’