A new attack called Kraken is discovered that injected its payload into the Windows Error Reporting (WER) service as a defense evasion mechanism. An unknown hacking group injected malicious code within the legitimate Windows Error Reporting (WER) service to evade detection as part of a fileless malware attack. Exploiting the WER service in attacks for defense evasion is not a new tactic but this campaign is most likely the work of a yet unknown cyber espionage group. That reporting service, WerFault.exe, is usually invoked when an error related to the operating system, Windows features, or applications happens. When victims see WerFault.exe running on their machine, they probably assume that some error happened, while in this case they have actually been targeted in an attack.
This campaign is likely the work of an APT group that had earlier used a phishing attack enticing victims with a worker’s compensation claim. The threat actors compromised a website to host its payload and then used the CactusTorch framework to perform a fileless attack followed by several anti-analysis techniques. Some elements of the attack remind us of the Vietnamese APT32 group. This new attack started from a zip file containing a malicious document most likely distributed through spear phishing attacks. The document “Compensation manual.doc” pretends to include information about compensation rights for workers:
The file contains an image tag (“INCLDEPICTURE“) that connects to “yourrighttocompensation[.]com” and downloads an image that will be the document template.