The Center East and North Africa have turn out to be the goal of a brand new marketing campaign that delivers a modified model of a recognized malware referred to as AsyncRAT since September 2024.
“The marketing campaign, which leverages social media to distribute malware, is tied to the area’s present geopolitical local weather,” Optimistic Applied sciences researchers Klimentiy Galkin and Stanislav Pyzhov stated in an evaluation printed final week. “The attackers host malware in authentic on-line file-sharing accounts or Telegram channels arrange specifically for this objective.”
The marketing campaign is estimated to have claimed roughly 900 victims because the fall 2024, the Russian cybersecurity firm added, indicating its widespread nature. A majority of the victims are situated in Libya, Saudi Arabia, Egypt, Turkey, the United Arab Emirates, Qatar, and Tunisia.
The exercise, attributed to a risk actor dubbed Desert Dexter, was found in February 2025. It mainly entails creating momentary accounts and information channels on Fb. These accounts are then used to publish ads containing hyperlinks to a file-sharing service or Telegram channel.
The hyperlinks, in flip, redirect customers to a model of the AsyncRAT malware that has been altered to incorporate an offline keylogger; seek for 16 totally different cryptocurrency pockets extensions and purposes; and talk with a Telegram bot.
The kill chain begins with a RAR archive that both features a batch script or a JavaScript file, that are programmed to run a PowerShell script that is answerable for triggering the second stage of the assault.
Particularly, it terminates processes related to varied .NET companies that would forestall the malware from beginning, deletes information with the extensions BAT, PS1, and VBS from “C:ProgramDataWindowsHost” and “C:UsersPublic” folders, and creates a brand new VBS file in C:ProgramDataWindowsHost, and BAT and PS1 information in C:UsersPublic.
The script then establishes persistence on the system, gathers and exfiltrates system info to a Telegram bot, takes a screenshot, and in the end launches the AsyncRAT payload by injecting it into the “aspnet_compiler.exe” executable.
It is presently not recognized who’s behind the marketing campaign, though Arabic language feedback within the JavaScript file allude to their doable origin.
Additional evaluation of the messages despatched to the Telegram bot has revealed screenshots of the attacker’s personal desktop named “DEXTERMSI,” that includes the PowerShell script in addition to a software named Luminosity Hyperlink RAT. Additionally current within the Telegram bot is a hyperlink to a Telegram channel named “dexterlyly,” suggesting that the risk actor may very well be from Libya. The channel was created on October 5, 2024.
“The vast majority of victims are bizarre customers, together with workers within the following sectors: Oil manufacturing, development, info know-how, [and] agriculture,” the researchers stated.
“The instruments utilized by Desert Dexter aren’t significantly subtle. Nevertheless, the mix of Fb advertisements with authentic companies and references to the geopolitical state of affairs has led to the an infection of quite a few gadgets.”
The event comes as QiAnXin revealed particulars of a spear-phishing marketing campaign dubbed Operation Sea Elephant that has been discovered focusing on scientific analysis establishments in China with the objective of delivering a backdoor able to harvesting delicate info associated to ocean sciences and applied sciences.
The exercise has been attributed to a cluster named UTG-Q-011, which, it stated, is a subset inside one other adversarial collective referred to as CNC group that shares tactical overlaps with Patchwork, a risk actor suspected to be from India.