Talos details LilacSquid, a suspected data-theft APT active since 2021, using a modular infection chain with MeshAgent, PurpleInk, InkBox, and InkLoader to siphon data from diverse targets. The operation combines exploitation of public-facing app vulnerabilities and stolen RDP credentials to establish long-term footholds for exfiltration. #LilacSquid #PurpleInk #InkLoader #InkBox #MeshAgent #QuasarRAT #Lazarus #Andariel #3CX #X_Trader
Keypoints
- LilacSquid is a suspected data-theft APT active since at least 2021, attributed by Talos to an actor tracked as LilacSquid/UAT-4820.
- Victims span IT/software developers, energy sector entities in Europe, and pharma firms in Asia, suggesting cross-vertical targeting.
- The campaign relies on MeshAgent and PurpleInk as primary implants, with InkBox and InkLoader serving as loaders in the infection chain.
- Two initial access methods are used: exploiting vulnerabilities in public-facing apps and using stolen remote desktop credentials.
- Post-exploitation deploys MeshAgent to contact C2 and install additional implants like SSF and PurpleInk, enabling long‑term data theft.
- PurpleInk is heavily obfuscated with configurable C2, and can enumerate processes, read and exfiltrate files, and control the infected host; InkLoader persists across reboots to deploy PurpleInk.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – The campaign leverages vulnerabilities in public-facing application servers to compromise targets. “[This campaign leverages vulnerabilities in public-facing application servers…](translated quote in English)”
- [T1021.001] Remote Services: RDP – Initial access via compromised remote desktop protocol credentials. “[compromised remote desktop protocol (RDP) credentials](translated quote in English)”
- [T1197] BITS Jobs – MeshAgent is typically downloaded by the attackers using the bitsadmin utility. “[MeshAgent is typically downloaded by the attackers using the bitsadmin utility](translated quote in English)”
- [T1105] Ingress Tool Transfer – MeshAgent is downloaded and executed to establish contact with the C2. “[MeshAgent is typically downloaded… and then executed to establish contact with the C2.](translated quote in English)”
- [T1047] Windows Management Instrumentation – Gathers system information about the infected host using WMI queries. “[Gathers system information about the infected host using WMI queries.](translated quote in English)”
- [T1082] System Information Discovery – Information gathered includes processor name, memory, drives, and more. “[Information includes: Processor name, RAM, etc.](translated quote in English)”
- [T1057] Process Discovery – Enumerate the process and send the process ID, name and associated Window Title to the C2. “[Enumerate the process and send the process ID, name and associated Window Title to the C2.](translated quote in English)”
- [T1083] File and Directory Discovery – Enumerate directories to obtain file names and sizes. “[Enumerate a given directory to obtain underlying directory names, file names and file sizes.](translated quote in English)”
- [T1005] Data from Local System – Read a file and exfiltrate its contents. “[Read a file specified by the C2 and exfiltrate its contents.](translated quote in English)”
- [T1543.003] Create or Modify System Process: Windows Service – InkLoader/service creation to persist. “[sc create TransactExDetect displayname=Extended Transaction Detection… start= auto]”
- [T1140] Deobfuscate/Decode Data – PurpleInk configuration is base64-decoded and decrypted. “[base64-decoded and decrypted to obtain the configuration strings…](translated quote in English)”
- [T1572]Protocol Tunneling – SSF tunnels via TLS to remote servers for proxying and exfiltration. “[Secure Socket Funneling (SSF)… proxying and tunneling multiple sockets through a single secure TLS tunnel to a remote computer.](translated quote in English)”
- [T1090] Proxy – Lazarus-like use of SOCKS proxy and tunneling tools for secondary access and exfiltration. “[SOCKs proxy and tunneling tools, along with custom-made malware…](translated quote in English)”
- [T1041] Exfiltration Over C2 Channel – Data exfiltration to attacker-controlled servers via C2. “[exfiltration to attacker-controlled servers.](translated quote in English)”
Indicators of Compromise
- [Hash] PurpleInk hash – 2eb9c6722139e821c2fe8314b356880be70f3d19d8d2ba530adc9f466ffc67d8
- [IP Address] Network IOC – 67.213.221.6, 192.145.127.190, 45.9.251.14, 199.229.250.142
- [Windows Service] TransactExDetect – service name used in the infection chain (sc create TransactExDetect …).