DarkCasino: A New Emerging APT Threat Exploiting a WinRAR Flaw

Background:

When tracking the exploitation of WinRAR vulnerabilities, NSFOCUS Research Labs discovered a large number of attacks by known APT organizations as well as unconfirmed attackers. The majority of these attacks were directed at national governments or global organizations.

APT DarkCasino:

DarkCasino is a financially driven APT group first discovered in 2021. The term DarkCasino is derived from a large-scale APT attack of the same name that was intercepted by NSFOCUS Research Labs in 2022. DarkCasino’s APT group primarily targets various online trade platforms in Europe, Asia, the Middle East, and other countries, including cryptocurrency, online casinos, network banks, and online credit platforms. DarkCasino is skilled at acquiring credentials from target hosts in order to get assets put by victims in online accounts.

DarkCasino is an APT threat actor with high technical and learning capabilities, and it excels at incorporating popular APT attack methods into its assault process. DarkCasino initially based its phishing attempts on the attack concept of an APT attacker dubbed Evilnum, employing malicious shortcuts, image steganography, and other technologies. Because the overall process design was similar to that of Evilnum, NSFOCUS Research Labs once attributed this organization to Evilnum; however, after H2 2022, DarkCasino gradually abandoned the Evilnum-borrowed attack idea and developed a set of multi-level loading patterns based on several Visual Basic components, allowing it to implement many larger-scale network attacks.

CVE-2023-38831:

CVE-2023-38831 is an arbitrary execution vulnerability in WinRAR software that was exploited in April 2023 by DarkCasino and addressed in WinRAR v6.23 in August 2023.

CVE-2023-38831 is based on the file running mechanism of the WinRAR software. It spoofs the API function ShellExecuteExW called by WinRAR by constructing a decoy file, a folder with the same name as the decoy file, and a malicious file with the same name with a space at the end of the folder, allowing it to release and execute the malicious file when the decoy file should have been opened.

Exploitation of CVE-2023-38831:

DarkCasino created a new attack pattern and launched a fresh round of attacks targeting internet trading forums in April 2023. In this new attack pattern, DarkCasino used a WinRAR zero-day vulnerability to place malicious programs within specially created vulnerability zip files for phishing attacks against forum participants via online trading forum posts.

NSFOCUS Research Labs discovered that DarkCasino used these vulnerabilities to compress files, resulting in two attack processes. The core logic of these two attack procedures is nearly identical, with the key difference being the Trojan data storage format.

The following diagram depicts the primary components of this attack procedure, which include the CVE-2023-38831 vulnerability exploitation file, Cabinet archive file, registry file, and ActiveX control file. There are three stages to it: vulnerability exploitation, load release, and Trojan execution.

Fig. Attack Process of DarkCasino (NSFocus)

When NSFOCUS Research Labs examined the impact surface of vulnerability CVE-2023-38831, it discovered that since the vulnerability’s disclosure in August 2023, multiple APT organizations and unconfirmed attackers have used it for phishing attacks, the majority of which target important government agencies in various countries.

NSFOCUS Research Labs also discovered a huge number of exploitation files created and distributed by phishing email hackers around the world, indicating that the vulnerability has been widely abused.

Multiple threat actors have joined the CVE-2023-38831 exploitation bandwagon in recent months, including APT28, APT29, APT40, Dark Pink, Ghostwriter, Konni, and Sandworm.

Recommendations:

• This vulnerability affects all versions of WinRAR prior to 6.23. It is recommended that you update WinRAR to the most recent version. Updating your software applications, browsers, and gadgets on a regular basis is an important security practice that can help protect your systems against known vulnerabilities and cyber threats.
• Conduct simulated attack scenarios to ensure that staff are aware of phishing and other threats and that incidents are reported to the internal cybersecurity team.
• Segment the network to keep critical systems and sensitive data separate from the rest of the network. This helps to limit potential breaches and reduces attacker lateral movement.
• Proper logging, asset visibility, and system monitoring are critical components of a strong cybersecurity strategy. These methods give a network overview and aid in the detection of anomalies that may signal a security threat.

IOCs: