The Intricate Babylon RAT Campaign Targets Malaysian Politicians, Government – Cyble

Summary: A targeted cyber-attack has been identified by Cyble Research and Intelligence Lab (CRIL) against political figures and government officials in Malaysia, utilizing malicious ISO files to deploy the Babylon RAT. The campaign highlights advanced tactics and persistence in compromising high-profile individuals and institutions.

Threat Actor: Unknown | unknown
Victim: Malaysian political figures and government officials | malaysian government officials

Key Point :

• The campaign has been active since July and employs at least three distinct malicious ISO files targeting Malaysian entities.
• Babylon RAT is delivered as the final payload, providing unauthorized access to the victim’s machine for data exfiltration and remote control.
• The attack utilizes deceptive elements, including a shortcut file disguised as a PDF, to execute a hidden PowerShell script that installs the RAT.
• Indicators of compromise include specific SHA-256 hashes and IP addresses associated with the command-and-control servers.

Key takeaways 

• Cyble Research and Intelligence Lab (CRIL) has identified a highly targeted cyber-attack aimed at political figures and government officials, in Malaysia.  
• The attack showcases the advanced tactics employed by Threat Actor (TA) in targeting high-profile individuals and institutions. 
• The campaign active since July, has employed at least three distinct malicious ISO files specifically designed to compromise Malaysian entities. 
• The malicious ISO files contain multiple components, including a shortcut (LNK) file, a hidden PowerShell script, a malicious executable, and a decoy PDF file.  
• The campaign delivers Babylon RAT as a final payload.  
• Babylon RAT, an open-source Remote Access Trojan (RAT), provides unauthorized access to the victim’s machine. It allows the TA to execute commands remotely, control the system, and exfiltrate sensitive data.  
• Intelligence from Cyble Vision’s platform indicates that the TA behind this campaign has previously targeted Malaysian entities using Quasar RAT, another open-source RAT. 

Overview 

Cyble Research and Intelligence Lab (CRIL) has recently discovered a campaign involving malicious ISO files, targeting political figures and government officials within Malaysia. The initial infection vector for this campaign is unclear. The ISO file is crafted with deceptive elements to trick users into thinking they are interacting with legitimate files.  

It contains a visible shortcut file that mimics a PDF document, alongside a hidden malicious executable, a lure PDF document, and a concealed PowerShell script. 

Upon opening the shortcut file, the PowerShell script executes sneakily in the background, which then launches the decoy PDF and copies the malicious executable to the %appdata% directory. The script also creates a registry entry to ensure the executable runs on system startup and then executes the malicious file. 

The final payload in this campaign is Babylon RAT, an open-source Remote Access Trojan (RAT) designed for comprehensive surveillance and data theft. Babylon RAT offers a wide range of malicious functionalities, including capturing keystrokes, clipboard monitoring, password extraction, and remote command execution.  

It enables TAs to covertly monitor user activity and steal sensitive information. The RAT maintains persistence on infected systems through registry modifications, ensuring it can survive reboots and continue operations.  

Additionally, Babylon RAT includes a sophisticated control panel, allowing TAs to efficiently manage compromised systems, execute commands remotely, and access stolen data, making it a powerful tool for cyber espionage and data exfiltration. The below Figure shows the Infection chain 

Figure 1 –  infection chain 

Technical Analysis 

This campaign has been active since last July, with three distinct malicious ISO files observed targeting Malaysian entities. The use of three different lure documents suggests an attempt to reach a broader audience.  

At the end of July, we observed two ISO files: one containing a lure document addressing political concerns in Malaysia, suggesting the campaign targets politically engaged individuals in the country. The other ISO file included a lure related to Majlis Amanah Rakyat (MARA), indicating that the TA is targeting Malaysian government officials. The below figure shows the lure documents observed in July. 

Figure 2 – Lure Document 

Figure 3 – Lure Document 

At the end of August, we identified another malicious ISO file with a lure document related to the MyKHAS system, indicating that the TA is targeting Malaysian government officials who use the MyKHAS platform as shown below.  

Figure 4 – Lure Document 

In all three ISO files, a similar approach is used: each contains a visible shortcut file that resembles a PDF document, as well as a hidden malicious executable, a lure PDF document, and a concealed PowerShell script as shown in the below figure.  

Figure 5 – inside iso file once mounted 

For analysis, we are examining the ISO sample identified in August named “PANDUAN_PENGGUNA_MyKHAS.iso” with the sha256 value “d9f0268cbaa1ae45dfa755adab9dda2d8bdff3c8bf8a00d23bbc6894c28e225f”. When the user opens the [.]lnk file, it silently executes the hidden PowerShell script in the background. This execution is triggered by a command line embedded in the shortcut file, as mentioned below. 

• “%windir%/System32/cmd.exe /c powershell -WindowStyle hidden -nologo -executionpolicy bypass -File “PANDUAN_PENGGUNA_MyKHAS.ps1” 

Following this, the PowerShell script (.ps1) opens a decoy PDF file using the “Invoke-Item” command. It then copies the malicious executable, ‘controller.exe,’ into the Windows “%appdata%” directory via the “Copy-Item” command.  

To ensure the executable runs automatically at system startup, the script adds a startup entry in the registry under “HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun” with the name “USBController.” Lastly, the script launches “controller.exe” from the current directory using the “Invoke-Expression” command. 

Later, the PowerShell script (.ps1) opens the decoy PDF file using the “Invoke-Item” command. It then copies the malicious executable, ‘controller.exe,’ to the “%appdata%” directory using “Copy-Item”. The script creates a startup entry in the registry under “HKCU:SOFTWAREMicrosoftWindowsCurrentVersionRun” with the name “USBController” ensuring “controller.exe” is executed automatically on system startup.  

Finally, the script starts “controller.exe” from the %appdata% directory using Invoke-Expression. The below figure shows the content of the malicious PowerShell script. The executable “controller.exe” has been identified as wrapper for Babylon RAT, an open-source remote access tool (RAT) commonly used by TAs for cyber espionage and data exfiltration. 

Figure 6 – PowerShell script 

Payload analysis 

During our analysis, we discovered that the file “Controller.exe” contains a significant data overlay, approximately 300MB in size, which appears to be intentionally designed to evade detection by security products. This file employs “Dynamic API Resolution” using “GetModuleHandle” and “GetProcAddress”. This technique allows the wrapper to dynamically call Win32 cryptographic APIs to decrypt its embedded encrypted content. Specifically, it uses the below shown base data value to generate a 256-bit key via the “CryptDeriveKey” function, which is subsequently used with the AES-256 algorithm in the “CryptDecrypt” API to decrypt the payload. 

Figure 7 – BaseData Value for CryptDeriveKey to create key for AES_256 
 

Figure 8 – Decrypted payload 

The decrypted payload, is again packed with an UPX packer, further the execution is transferred to the decrypted payload using the “CreateThread” windows API as shown in below figure  

Figure 9 – Thread Creation 

Babylon Rat 

The decrypted payload is a Babylon RAT, which is an open-source remote access tool (RAT) widely used by cybercriminals for espionage and data theft. It allows TAs to take full control of a victim’s machine remotely, enabling actions like file manipulation, process management, and command execution. The RAT includes keylogging features, capturing user keystrokes to steal sensitive information like passwords. It also supports clipboard monitoring and can take screenshots of the victim’s desktop. Persistence mechanisms allow it to survive reboots by modifying system settings or registry keys.  

Babylon RAT communicates with a command-and-control (C2) server for further instructions, data exfiltration, and payload delivery. It is often used for long-term surveillance and data harvesting in targeted cyberattacks. The below Figure shows the Babylon RAT string present in the process memory. 

Figure 10 – Babylon Rat 

C&C Communication: 

The Babylon RAT samples observed in this campaign connect to command-and-control (C&C) servers at 149.28.19[.]207 and 64.176.65[.]152 over port 443, enabling TAs to gain control of the infected machine and exfiltrate sensitive data. While the identity of the TA behind this campaign remains unknown, intelligence from the Cyble Vision Platform indicates that these Malaysian entities were also targeted using Quasar RAT in the past. 

Figure 11 –IP Address 64.176.65[.]152 Details in Cyble Vision  

Conclusion 

The sophisticated cyber-attack targeting political figures and government officials in Malaysia showcases the heightened interest and advanced techniques of the TAs. The ongoing campaign, involving malicious ISO files, highlights the severity of the threat and the persistent nature of such attacks. The use of Babylon RAT, an open-source Remote Access Trojan, illustrates the capability of these TAs to gain unauthorized control and exfiltrate sensitive data. Additionally, the recurrence of targeting Malaysian entities with similar tools, such as Quasar RAT, emphasizes the need for enhanced security measures and vigilance to defend against these evolving cyber threats. 

Recommendations 

• Implement advanced email filtering solutions to detect and block malicious attachments, such as ISO files, and prevent them from reaching end users. 
• Deploy and regularly update endpoint security solutions, including antivirus and anti-malware software, to detect and mitigate threats like Babylon RAT. 
• Implement continuous network monitoring and anomaly detection to identify and respond to unusual activities or unauthorized connections, especially those involving command-and-control servers. 
• Conduct comprehensive security awareness training for political figures, and government officials to recognize and avoid phishing attempts and malicious files. 
• Ensure that all systems and software are kept up to date with the latest security patches to reduce vulnerabilities that could be exploited by threat actors. 

MITRE ATT&CK® Techniques 

Indicators Of Compromise 

Related

Source: https://cyble.com/blog/the-intricate-babylon-rat-campaign-targets-malaysian-politicians-government