Research by: Antonis Terefos, Raman Ladutska
Part I from the series E-Crime & Punishment
When considering a notoriously famous topic known for quite a long time, it may feel like there is nothing new to add to this area anymore – all paths traced, all words said, all “i”s dotted. Is it worth an investigation to begin with? As it turns out, there are new discoveries with previously hidden information of valuable significance that can be built into the already-painted picture.
In this research series conducted by Check Point Research (CPR), the Agent Tesla malware acts as the master villain. It is an example of an advanced remote access trojan (RAT) specializing in the theft and infiltration of sensitive information from infected machines. This malware can collect various types of data, including keystrokes and login credentials used in browsers (such as Google Chrome and Mozilla Firefox) and email clients used on infected machines. Agent Tesla is a malware family with a rich and infamous history in the cyber landscape: it has been repeatedly included in the monthly reports of top 10 prevalent malware families since 2020.
Check Point Research uncovered a recent malware campaign of Agent Tesla operation aimed against American and Australian organizations. On the 7th of November 2023, an Agent Tesla campaign started against Australian organizations, and the same actor performed another campaign targeting mainly Australian entities. Phishing campaigns mainly target organization email credentials to access entities and perform further campaigns but with the next goal, to execute the malware samples of Agent Tesla. In this case, the attack base constituted 62,000 emails.2 subsequent spam campaigns were launched on the 8th and 30th of November.
After further investigation, CPR tracked down the activity of 2 cyber-crime actors behind Agent Tesla operations with the evidence of being connected with each other:
- Bignosa (main threat actor)
- Gods
The main actor appears to be a part of a group operating malware and phishing campaigns, targeting organizations, which is testified by the US and Australian email business databases, as well as individuals. Apart from campaigns originating from companies’ victims, the group maintains a large number of servers, which are used either for RDP connections or for malware campaigns using Round Cube – separate machines are used for consequent steps in the cyber-operations.
The malicious campaigns were all conducted in the same manner. The spam emails are prepared abusing the formal mail from with the topic of purchasing goods and order delivery, social engineered in a way to increase the probability of the victim to click the button and initiate the infection chain.
Upon clicking on the email, the Agent Tesla sample protected by the Cassandra Protector is downloaded to the victim’s machine and executed. The Cassandra protector is designed to work exclusively with .NET samples and introduces various features: anti-AV and anti-emulation tricks or signing the resulting file with the certificate – to name a few. We will describe this protector in more details in the section linked to the “Bignosa” actor.
Below, we present the details of the investigation, reveal clues that allowed us to draw connections between various pieces of information, make breakdowns of steps and timeframes during the malicious campaigns, link actors with each other, and uncover their identities.
The malware campaigns were meticulously prepared, rather than simply initiating the spam with a single click, The diagram below shows the times of preparation and execution steps:
Phishing texts used in these campaigns appear to be taken from the following sites:
Malware campaigns 7-8th of November
On the 7th of November, the main threat actor “Bignosa” launched a malware campaign targeting more than 11,000 Australian companies. The actor possesses email databases focused on different attack targets, and for this campaign, Australian recipients have been chosen:
- US Businesses (”USA Database 2.txt”)
- AU Businesses (”AU B2B Lead.txt”/”Australia Mail list.doc”)
- Educational (”Edu Email.txt”)
The campaign was performed by “Bignosa” using the email [email protected] with an attachment PDF.IMG, which is a disguised Agent Tesla sample, is protected with the Cassandra Protector.
The server chserver.top-172.81.60.206 is a server that belongs to the actor, he installed Plesk and Round Cube to perform the campaign on the previous day at 19:57:46. “Bignosa” connected to it with SSH using an IP from Kenya 41.90.185.44. The actor used RDP to connect to the machine 91.215.152.7, logged in to Webmail, and launched the spam campaign.
The principal scheme of this operation is shown in the diagram below:
Malware campaign 29-30th of November
On the 29th of November, the threat actor from 41.90.177.10 connected via SSH to 192.236.236.35 and installed Plesk & Round Cube once again. Using his Bulgarian RDP connection, 91.215.152.7, he created an email address and logged into Webmail. Around 16:00, the machine was ready for the campaign.
On the 30th of November, “Bignosa” executed the campaign targeting multiple organizations in Australia and United States. The file attachment was once again an Agent-Tesla with the same C&C as the campaign earlier in the month.
The principal scheme of this operation is shown in the diagram below:
The schemes are similar in both campaigns except for the addresses of the server where Plesk and RoundCube were installed – these are the only differences between the attacks.
Cassandra Protector
During both campaigns “Bignosa” used Cassandra Protector to obfuscate the samples’ initial code and later convert the executables into ISO. The actor has been a customer of Cassandra Protector since 24/6/2023 (with that specific email):
Cassandra Protector has been used to “protect” 67 samples:
Cassandra Protector supports only .NET samples and provides various functionalities such as (as described on the sales site):
- Injection method.
- Persistence method.
- Anti-Virus & Emulation.
- Delaying execution.
- Signing protected with a Certificate.
- Icon Change.
- Pop-up message box with custom text.
- Custom Assembly features.
- Create and execute downloader.
- Protection options.
Cassandra Protector allows the end user to choose a file to be downloaded and/or executed after launch, lets configure sleep time before continuing execution and choose a fake message box to be shown.
Under the hood the Protector has the capabilities of putting itself to Defender exclusion via Powershell:Add-MpPreference –ExclusionPath command. It can copy itself to the “AppData” folder, set the file as hidden/system and set a new ACL (Access Control List). For persistence Cassandra Protector adds the file to Scheduled Tasks.
The injection option is also configurable, it can be a PE Hollowing or .NET Reflection to itself:
Once the sample was “protected”, the actor used ISO Burner to convert the .NET into an ISO file with “.img” extension and attached the resulting file to spam emails.
We have covered the technical aspects of the campaigns; now we will examine the profiles of threat actors linked to these campaigns, starting with the main one – “Bignosa.”
First Threat Actor – Bignosa
The Threat Actor “Bignosa” was behind the described campaigns. “Bignosa” appears to have been using Agent Tesla for quite a while and performing phishing attacks in the past as well.
This actoruses another alias as well as a name which gives an indication of where he is originally from. The nickname that was also observed was Nosakhare which is of Nigerian origin and means “What God say will be/is destiny”.
The further profile description is tightly connected with the other Threat Actor who appears to be assisting “Bignosa” in allegedly taking the first steps into the malware world on the rights of a seemingly more experienced one. The nickname of the other Threat Actor is “Gods.” A bright example of the interaction between the two is shown on the Skype excerpt where “Bignosa”gets advice from “Gods” (live:.cid.1b6f75099c70b269) regarding which malspam text to use for the campaign.
The actors have been observed to communicate via Jabber – a service for instant messaging via an open protocol used since 1999 – where, in multiple instances, “Bignosa” wasn’t able to clean his machine from the Agent Tesla test infections and provided a Team Viewer access to “Gods” for assistance in cleaning up the machine.
The following screenshot shows how “Gods” connected via Team Viewer to the “Bignosa” machine to remove Agent Tesla infection:
Initially, we considered the collaboration between “Bignosa” and “Gods” to be solely in the form of a “student-mentor” role model. However, later findings suggest a closer collaboration between the two actors and show evidence of them performing as a group. We will get back to this after we take a closer look at the profile of the “God’s” threat actor right in the next section.
We summarize the information mapped to the activities of “Bignosa” in the diagram below:
According to the name “Nosakhare” that was used by the threat actor, the “NG” acronym in Skype, Kenyan traces in the malicious campaigns, and several other clues – we can draw a conclusion that we’re dealing with a Kenyan man Nosakhare Godson. There is a LinkedIn profile revealing the photo of this person:
Other bits of interest to add to his profile come from examining his RDP desktop:
We can spot three other malware families on this desktop: Quasar, Warzone, and PureCrypter. Quasar and Warzone are available in the public access, and Quasar is even open-sourced, so the “modified” suffix in the folder name implies that the malware code could be edited to suit the needs of the actor. There is a tutorial in a separate file describing the usage of PureCrypter.
There are separate files with the emails of Australian and miscellaneous customers, as well as the whole folder with the USA victims. Grammarly is also part of the actor’s toolkit in his spam activities. SuperMailer is seen as (likely) the test tool as it was not used in the malicious campaigns. The application was not bought as evidenced by the crack for it also seen in the desktop – probably to save money whenever possible for maximum profit from malicious activities. Another piracy evidence is the folder with the name “activator.”
Having familiarized ourselves with the main actor, it’s time to investigate the activities of the one using the “Gods” alias – the mentor of “Bignosa”.
Second Threat Actor – Gods/Kmarshal
This Threat Actor has been performing phishing attacks since March 2023 and then transitioned to malspam and malware operations around June 2023. Those phishing attacks appear to have been reporting the data to “[email protected]”:
The campaign conducted around June 2023 involved several widely used services, Microsoft sign-in form as one of the vivid examples:
On the 15th of August “Gods” appears to have performed a malware campaign connecting via RDP to VDS server 79.110.48.6 and then to Webmail. This campaign targeted a mix of Australian and UK companies using “Agent Tesla” as well.
This actor uses two nicknames more frequently than the others – “Gods” and “Kmarshal” – as present in the threat actor’s Jabber account:
This fact potentially allows us to assume that there could possibly be, at least two persons behind this threat actor. However, future findings proved that all the nicknames belonged to one person. Let us see the clues we have gathered regarding this threat actor.
We identified that two machines related to “Gods”had usernames with prefixes “km” and “KM”:
One of the machines has the name “KM-MacBook-Pro”. He is part of a chat group in Jabber where 10 other contacts are present:
We found that the email that is used by “Gods” threat actor – [email protected] – appears to be the same as from the YouTube channel “8 Letter Tech”:
This channel contains videos on setting up 
