Rewterz Threat Alert – Hacker-for-hire Mercenary Group CostaRicto Launches Cyber Attacks

Severity

High

Analysis Summary

A new hacker-for-hire mercenary group is detected with ties to attacks targeting victims all over the world. The group named CostaRicto, is the fifth hacker-for-hire group discovered this year. Details about CostaRicto’s current origins and whereabouts still remain unknown. The group has orchestrated attacks all over the globe across different countries in Europe, the Americas, Asia, Australia, and Africa. However, the biggest concentration of victims appears to be in South Asia, and especially India, Bangladesh, and Singapore, suggesting that the threat actor could be based in the region. The victims’ profiles are diverse across several verticals, with a large portion being financial institutions. The group is using custom-built and never-before-seen malware, however they are not operating using any innovative techniques. Most of their attacks rely on stolen credentials or spear-phishing emails as the initial entry vector. These emails usually deliver a backdoor trojan named Sombra or SombRAT. The backdoor trojan allows CostaRicto operators to access infected hosts, search for sensitive files, and exfiltrate important documents. This data is usually sent back to CostaRicto command-and-control infrastructure, which is usually hosted on the dark web, and accessible only via Tor. Furthermore, the infected hosts usually connect these servers via a layer of proxies and SSH tunnels to hide the malicious traffic from the infected organizations.

Impact

• Credential Theft
• Data Exfiltration
• Theft of Sensitive Information
• Unauthorized Remote Access

Indicators of Compromise

Domain Name

• infosportals[.]com
• mail[.]kub-gas[.]com
• akams[.]in
• newspointview[.]com

MD5

• 5b6af6264ba1289d0793e2be480ba80c
• 2eb116f76fcaedaac0e37c179ebd7c2b
• 3fdbd3bd4862eb294e2aaf96e8a1c14f
• d5a4616103aa0b458558c83f4faea5d4
• 05e133f34e44d75e596811bffba24156
• 084766595dcc2c0f06232fa0f447cb1a
• a6a34370a0ae552a4266b920738d3b14
• e10ba7d92ec75be0e74705e602a4070d
• eebb8497f6e92db77debe5bf6ebce48d
• 8b54da23ed16dca00d3188f419d697ea
• f43377b04b66d1aed783cd6037e3298d
• 69b064a335d76c261b1a26781ad77386
• 1829b57d3663eb987e26ed7065aa660b

SHA-256

• d69764b22d1b68aa9462f1f5f0bf18caebbcff4d592083f80dbce39c64890295
• fa74f70baa15561c28c793b189102149d3fb4f24147adc5efbd8656221c0960b
• ee0f4afee2940bbe895c1f1f60b8967291a2662ac9dca9f07d9edf400d34b58a
• 561bf3f3db67996ce81d98f1df91bfa28fb5fc8472ed64606ef8427a97fd8cdd
• f6ecdae3ae4769aaafc8a0faab30cb66dab8c9d3fff27764ff208be7a455125c
• c0db3dadf2e270240bb5cad8a652e5e11e3afe41b8ee106d67d47b06f5163261
• 8062e1582525534b9c52c5d9a38d6b012746484a2714a14febe2d07af02c32d5
• 6df8271ae0380737734b2dd6d46d0db3a30ba35d7379710a9fb05d1510495b49
• 7424d6daab8407e85285709dd27b8cce7c633d3d4a39050883ad9d82b85198bf
• 130fa726df5a58e9334cc28dc62e3ebaa0b7c0d637fce1a66daff66ee05a9437
• 79009ee869cec789a3d2735e0a81a546b33e320ee6ae950ba236a9f417ebf763
• 8323094c43fcd2da44f60b46f043f7ca4ad6a2106b6561598e94008ece46168b
• d8189ebdec637fc83276654635343fb422672fc5e3e2818df211fb7c878a3155

SHA1

• 5577a62645a5ed6559925fa46cbfa99cb301f4ca
• 7526bd5f857beb3ad44875c99c399c1400923a33
• 31947532ccc6bbd9e6d14b71f8a4fe37eed32651
• 3569146a3eb964b49e9bff6d1700c7b046148f15
• 0551083d22430deedc3c5bdca509a871f0128732
• a20eb3e605a9c04fca23c4cabfbe13248c9887e3
• a5bb2437e9f30a9271f90e7d1fe381a521e8b007
• b6e9fd7c82bd92913308e0a1c777aad3a1387c64
• d585f7d7736d8efd4b7b8d298ecb503bf60bbe3a
• 54bf0c8d459bfc8aad0eddcbffbcb51cc18000a1
• 57b068b2f9d44e432f7acd04f334b1390290e9c3
• d07e695e718206f0e679709deac71f87885db40f
• 4c25cd61bd6673bd3a75373e3ff9cd7567f2439f

Source IP

• 212[.]114[.]52[.]98
• 45[.]89[.]175[.]206
• 45[.]138[.]172[.]54
• 144[.]217[.]53[.]146
• 212[.]83[.]61[.]227
• 159[.]65[.]31[.]84

Remediation

• Block the threat indicators at their respective controls.
• Do not download files attached in untrusted emails.
• Enable multi-factor authentication and enable a strong password policy.