Severity
High
Analysis Summary
The OceanLotus Group aka APT32 is using a suite of remote access trojans dubbed “Ratsnif” to leverage new network attack capabilities. Researchers have analyzed the Ratsnif trojans, which offer a veritable swiss-army knife of network attack techniques. The trojans, under active development since 2016, combine capabilities like packet sniffing, gateway/device ARP poisoning, DNS poisoning, HTTP injection, and MAC spoofing.
Impact
Indicators of Compromise
URLs
http[:]//search[.]webstie[.]net/
Filename
Malware Hash (MD5/SHA1/SH256)
Remediation
Block all threat indicators at your respective controls.