#threatreport #LowCompleteness
Catlavan | 24-01-2025
Source:Key details below ↓

💀Threats:
Catlavan, 
🎯Victims: Game assistant users

🏭Industry: Entertainment

🌐Geo: Russian

🤖LLM extracted TTPs:`
T1027, T1056, T1041, T1560, T1119

🧨IOCs:
 - File: 7
 - IP: 1
 - Hash: 20

💽Software: Telegram

🔢Algorithms: md5, zip

🗂️Win API: ShellExecuteExA

#threatreport:
The exponential growth in the number of online game users has led to a corresponding increase in the gray industry of game plug-ins and auxiliary tools. Alongside this trend, numerous Trojan horse groups exploit these plug-ins to facilitate the propagation of malicious software. Tencent Cloud Security Threat Intelligence Center has identified multiple instances of malicious Trojan horses being disseminated through such plug-ins. In 2024, BinaryAI's malicious file detection engine introduced a novel approach by leveraging semantic-based killing engine technologies, underpinned by big model-related techniques, to enable end-to-end file detection. A particular incident discovered by BinaryAI targeted users of Russian-speaking game assistants and surfaced as an attack within a Catlavan compressed package, consequently termed the "Catlavan" backdoor. Notably, at the time of assessment, no other security software on VirusTotal had identified the sample.

Upon activation, the malicious server initiates a sequence designed to pilfer user information and transmit logs to an external attacker via the messaging platform Telegram. The malware triggers the Telegram interface upon execution, sending logs to a predetermined Telegram account. Subsequently, when the user interacts with a fake error message by clicking the "OK" button, a corresponding notification is dispatched to the remote Telegram account, documenting the action. The malware then commences data exfiltration by forwarding logs to the designated Telegram account. It proceeds to create a zip file within the temporary directory named with the current timestamp, systematically compressing and packaging all files within the Desktop directory. Progress updates are recorded and relayed to the Telegram account, with a log generated for every 1000 files processed. In cases where issues arise during the packaging process, the malware terminates the telegram.exe process using the taskkill command. Following the completion of the zipping operation, the server file establishes a connection with a Command and Control (C2) server and transfers the zip file to a specified directory on a remote SFTP server (/var/www/html/files/). Notably, the SFTP credentials, including the hardcoded hostname (SFTP_HOST = '93.185.157.131'), are embedded within the backdoor. Subsequently, additional logs are dispatched to the Telegram account, marking the conclusion of the malicious activity.

Further investigation into the attack's origins pinpointed its commencement in December 2024. The threat actor devised an auxiliary tool masquerading as a Minecraft game utility (in reality, a backdoor file) and distributed it across BBS forums and other platforms within the Russian gaming community. The intricate modus operandi of the malware underscores the evolving sophistication of cyber threats targeting gaming entities and stresses the critical necessity for robust cybersecurity measures to counter such malicious activities.
#threatreport #LowCompleteness