Arming WinRAR: deep dive into APTs exploiting WinRAR’s 0-day vulnerability - a SideCopy case study

Wednesday 2 October 17:00 - 17:30, Green room

Sathwik Ram Prakki (Quick Heal)

In the aftermath of the disclosure of vulnerabilities within WinRAR, a concerning trend has emerged wherein multiple advanced persistent threat (APT) groups and malicious actors have leveraged these weaknesses to launch targeted attacks on critical sectors spanning various nations. This presentation delves into the exploitation of a specific WinRAR vulnerability, CVE-2023-38831, offering insights into the vulnerability and the tactics employed by threat actors who disseminate malicious ZIP archives through phishing campaigns.

Focusing on a notable case study involving the SideCopy APT, this talk explores the intricacies of how WinRAR is weaponized to compromise the security of entities in India. The examination includes a detailed dissection of payloads such as AllaKore RAT, DRat, Key RAT, Double Action and Ares RAT, strategically deployed in a sophisticated multi-platform attack campaign featuring diverse decoys and a consistent naming convention. Furthermore, this presentation sheds light on the discovery of the infrastructure utilized by SideCopy APT, revealing insights into the group's modus operandi. Specific aspects of interest include the systematic reuse of IP addresses across multiple campaigns throughout the year, the utilization of various compromised domains as hosts for payloads, and the identification of shared code with the parent APT group Transparent Tribe (APT36).

Sathwik Ram Prakki Sathwik Ram Prakki works as Senior Security Researcher at Seqrite Labs, Quick Heal. His areas of research are threat intelligence, APT hunting, delving into dark web and malware analysis. With a background in offensive security and knowledge of OS internals, he is keen on enhancing detections and infrastructure for threat hunting and CTI. Starting his cybersecurity career at C-DAC, under the Ministry of Electronics & IT in India, Sathwik has shared insights on APTs, ransomware and malware ecosystems at conferences such as AVAR, Botconf and c0c0n.

Back to VB2024 Programme page

Back to VB2024 conference page

Register for VB2024

Other VB2024 papers