A Vietnamese hacker group targets Europe and Asia with their new PXA stealer

A new menace has emerged in the ever-evolving world of cyber threats, targeting government and education sectors across Europe and Asia. Known as PXA Stealer, this Python-based malware has been linked to a Vietnamese-speaking threat actor, raising concerns about cybercriminals’ growing sophistication. Researchers from Cisco Talos have uncovered the intricate workings of this malicious tool, designed to steal a wide range of sensitive information and pose a severe risk to its victims.

PXA Stealer represents a new wave of versatile and potent information-stealing malware. It has been meticulously engineered to target credentials for online accounts, VPNs, FTP clients, financial data, browser cookies, and even data from gaming software. Such a broad range of capabilities highlights the increasing scope of cyber threats in today’s interconnected world.

The primary focus of PXA Stealer’s campaign is government and educational institutions in Europe and Asia. These entities are often treasure troves of valuable data, making them high-priority targets for threat actors. The attack underscores the importance of robust cybersecurity measures in sensitive information sectors.

What sets PXA Stealer apart is its ability to decrypt browser master passwords and access stored credentials. This feature enables it to infiltrate online accounts seamlessly, allowing attackers to harvest sensitive data without raising immediate suspicion. The malware’s focus on critical assets like financial information and VPN credentials makes it exceptionally dangerous.

Evidence linking the campaign to Vietnam is compelling. The malware contains Vietnamese comments in its code, and a hard-coded Telegram account named “Lone None” features Vietnam’s national flag and the Ministry of Public Security emblem. These details suggest that the developers have ties to Vietnam, though their motivations remain unclear.

Including a hard-coded Telegram account highlights the platform’s increasing use by cyber criminals. Telegram’s encrypted and anonymous nature allows threat actors to coordinate attacks, share tools, and exfiltrate stolen data. This case further emphasizes the need to monitor such platforms closely.

PXA Stealer combines stealth, efficiency, and adaptability, unlike many other malware strains. Its Python-based framework allows for rapid customization and deployment, making it a formidable tool for skilled hackers. The ability to compromise credentials and bypass traditional security measures adds to its potency.

The ramifications for victims can be severe. By stealing credentials, attackers can gain unauthorized access to critical systems, leading to data breaches, financial losses, and potential national security threats. For educational institutions, the theft of research data and personal information could have long-term consequences.

This incident serves as a stark reminder of the importance of cybersecurity. Governments and educational institutions must prioritize implementing advanced protective measures, including endpoint detection, network monitoring, and regular software updates. Employee training on recognizing phishing attempts is also crucial.

Addressing threats like the PXA Stealer requires global cooperation. Cybersecurity organizations, governments, and tech companies must work together to share intelligence, develop countermeasures, and take action against cybercriminal networks. Public awareness campaigns can also play a key role in enhancing collective resilience.

As cyber threats evolve, organizations must adopt a proactive approach to security. Investing in threat intelligence, incident response plans, and zero-trust architectures can help mitigate risks. The PXA Stealer campaign is a wake-up call for all sectors to remain vigilant and prepared.

The emergence of PXA Stealer highlights the persistent and evolving nature of cyber threats. By understanding its tactics, techniques, and potential impact, organizations can better defend against similar attacks. In a world where cybercrime knows no borders, staying informed and prepared is the best defense.

Connections to the Underground Market

The discovery of the threat actor’s activities on Telegram highlights the platform’s role as a hub for cybercriminal operations. Cisco Talos researchers uncovered that the attacker is selling Facebook and Zalo account credentials and SIM cards through the Telegram channel “Mua Bán Scan MINI.” This channel was previously linked to another known threat actor, CoralRaider, who is raising suspicions about potential overlaps in their operations.

Telegram has become a favored platform for cybercriminals due to its encrypted communication, ease of use, and anonymity. Threat actors often use such channels to trade stolen data, offer hacking tools, or coordinate illegal activities. PXA Stealer-related operations on Telegram underscore how these platforms are increasingly exploited for cybercrime.

The Telegram channel “Mua Bán Scan MINI” has been linked to CoralRaider, a threat actor previously identified in various malicious campaigns. This overlap raises questions about whether Lone None and CoralRaider are part of the same group or merely sharing resources and tactics. The connection adds a layer of complexity to understanding the actor’s motives and reach.

Despite these overlaps, it remains to be seen whether Lone None and CoralRaider are directly linked or operate independently. While shared channels and activities suggest collaboration or resource sharing, there must be more direct evidence for speculation. This uncertainty highlights the fragmented and decentralized nature of cybercrime networks.

The attacker’s sale of Facebook and Zalo account credentials and SIM cards represents a lucrative black-market operation. These items are in high demand among cybercriminals, as they can be used for phishing attacks, identity theft, and account takeovers. This activity demonstrates the tangible financial incentives driving these campaigns.

The existence of marketplaces like “Mua Bán Scan MINI” and “Cú Black Ads – Dropship” shows how cybercriminals monetize stolen data and resources. These platforms provide a structured marketplace for illegal trade, making it easier for threat actors to profit from their campaigns and fueling the growth of cybercrime.

The overlapping activities between Lone None and CoralRaider underscore the difficulty of attributing specific actions to individual actors or groups. Threat actors often operate under multiple aliases, share tools, or collaborate loosely, making drawing clear boundaries between groups challenging.

The revelations about Lone None’s activities underline the need for cybersecurity organizations to monitor underground platforms like Telegram. By gathering intelligence from such sources, researchers can better understand threat actor tactics, techniques, and procedures (TTPs), potentially preventing future attacks and identifying connections between cybercriminal networks.

Sophisticated Tools and Attack Mechanisms Behind PXA Stealer

The threat actor associated with PXA Stealer has developed and distributed various automated tools designed to manage and exploit user accounts. These include a Hotmail batch creation tool, an email mining tool, and a Hotmail cookie batch modification tool. These utilities reflect the actor’s technical expertise and their intent to streamline malicious operations.

The attacker shares the executable files for these tools and includes their source code in the distributed packages. This level of transparency enables other malicious actors to customize and enhance these tools for their specific needs, broadening their potential misuse and contributing to a thriving underground ecosystem.

Evidence shows that these tools are marketed on platforms like aehack[.]com, which claims to provide free hacking and cheating utilities. The promotion is further amplified through YouTube tutorials, offering step-by-step instructions on using these tools. This organized marketing effort reveals the commercial aspect of cybercrime, where tools are commoditized for profit.

The propagation of PXA Stealer begins with a phishing email containing a ZIP file attachment. This attachment includes a Rust-based loader and a hidden folder housing several Windows batch scripts alongside a decoy PDF file. Phishing emails act as the first step in a carefully designed attack chain.

Once executed, the Rust-based loader triggers the batch scripts, opening the decoy PDF document and masquerading as a Glassdoor job application form. Simultaneously, PowerShell commands are executed to download and run additional payloads, including the PXA Stealer malware. This multi-step process ensures both the attack’s concealment and the malware’s effective deployment.

The attack chain includes sophisticated techniques to turn off antivirus software running on the host system. By neutralizing these defenses, the malware ensures an unimpeded path for deployment and subsequent data theft. This step highlights the attacker’s proactive measures to maintain control over the compromised system.

One of the standout features of PXA Stealer is its targeted approach to stealing Facebook cookies. These cookies are exploited to authenticate sessions and access Facebook Ads Manager and the Graph API. By leveraging these tools, the malware collects detailed information about the victim’s Facebook accounts, including ad-related data, which can be further monetized or used for malicious purposes.

From phishing emails to sophisticated tools and targeted cookie theft, the attack chain demonstrates a systematic and multi-layered approach to cybercrime. This level of sophistication underscores the growing threat organized cybercriminal groups pose and the importance of implementing robust defenses at every stage of the digital environment.

For more:

https://thehackernews.com/2024/11/vietnamese-hacker-group-deploys-new-pxa.html