Rewterz Threat Alert – Energy Sector Targeted By Karagany

Severity

Medium

Analysis Summary

A malware package known as “Karagany” (also known as xFrost). Karagany is a modular remote access Trojan (RAT) linked to a threat-group known as IRON LIBERTY (aka, DragonFly2.0 and Energetic Bear). Karagany is believed to have been developed from the source code of a malware package called “Dream Loader” after it was leaked in 2010. It is believed that IRON LIBERTY has invested significant time and effort into modifying the source to create a malware package suited to their own operations. IRON LIBERTY has been targeting the energy industry in the United States and Europe since at least 2010. After public exposure in 2014, Secureworks believes the group retired its own tools and infrastructure. Then, in 2016, they re-emerged once again with a fresh campaign. Samples of Karagany from 2016 to 2018 indicate constant development on the code. The core of Karagany provides persistence to the victim’s device, file upload and download, plugin execution, and limited browser credential harvesting. Infection of victims is through manual installs. The group targets specific individuals in specific roles to acquire their Active Directory credentials. Using PsExec, the group then initiates a remote command session to the targeted system and installs the malware. Persistence to survive a system reboot is achieved by creating a LNK file in the Startup folder that points back to the malware. Communication with its command and control servers is via HTTP and the data is secured using SSL/TLS.

Impact

Credential theft

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

• 20ec7658254eddd917e1b351e1728534
• 2618ab729dea68dfbcb11dce2e66c8c2
• 418e58b78731546089eb1b7fa6e1d99f
• 418e58b78731546089eb1b7fa6e1d99f
• 4ad06a76e1ad423b13e03587a887ede0
• 8aeacf3fde1b49940fb4d08226dccbc4
• fca1fa07afa1b3ff9f67f2a377de51ae
• fd6145bbc722ef52eed6b94dd520170c
• fff6dc1216fe549fa1d700f1ccfcd754

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/ attachments sent by unknown senders.