Unveiling a New Threat The Millenium RAT – CYFIRMA

MITRE Techniques

• [T1071.001] Web Protocols – Telegram-based C2 and data transmission – Leveraging the Telegram API for communication and file transmission, it poses substantial risks to both user privacy and system security. “Leveraging the Telegram API for communication and file transmission, it poses substantial risks to both user privacy and system security.”
• [T1547.001] Registry Run Keys/Startup Folder – Auto-start persistence – The RAT ensures that it runs automatically upon system startup. “writes a new registry entry to the ‘HKCUSoftwareMicrosoftWindowsCurrentVersionRun’ path. The entry created is named with the name ‘ChromeUpdate’…”
• [T1497] Virtualization/Sandbox Evasion – Anti-VM/sandbox checks – The RAT checks for signs of VirtualBox or other virtual machine software by gathering system information. “…to identify virtual environments and searches for keywords like ‘VIRTUAL,’ ‘vmware,’ or ‘VirtualBox’ within system details.”
• [T1498] Execution Guardrails – Anti-debugging measures – It attempts to detect if the application is running within a debugger. “It attempts to detect if the application is running within a debugger.”
• [T1056] Input Capture – Keylogging – The malware logs keystrokes by intercepting low-level keyboard input events. “logs keystrokes by intercepting low-level keyboard input events.”
• [T1555.003] Credentials from Web Browsers – Browser-stored credentials – It gathers data from several browsers (Chrome, Edge, Opera, Brave) and can access passwords, downloads, and more. “terminating any running instances of these browsers… collect passwords, downloads, credit card details, cookies, and browsing history.”
• [T1081] Credentials in Files – Local credential storage – It reads browser data files and other credential stores. “the data is organized, compressed, and sent… using the Telegram API.”
• [T1113] Screen Capture – Desktop screenshot – The malware captures the desktop, saves as JPEG, and sends via Telegram. “The desktop’s content, converts it into a JPEG image, and transmits it to a designated Telegram chat.”
• [T1002] Data Compressed – Data preparation for exfiltration – Data is compressed (ZIP) before exfiltration. “data is organized, compressed, and sent… via Telegram API.”
• [T1041] Exfiltration Over C2 Channel – Exfiltration to Telegram – Data and files are transmitted to the Telegram-based channel for exfiltration. “sent to an external server… Telegram API.”
• [T1485] Data Destruction – Self-deletion/destruction – Self-installation/self-destruction and cleanup actions are described. “self-destruction features… deletes artifacts.”
• [T1021] Remote Services – Remote control – The RAT enables remote control over the infected system. “enable remote control over the compromised system.”