HiatusRAT Malware Targets US Defense Department

Posted: August 23, 2023 to Cybersecurity.

Tags: Malware, CMMC, Work from Home

HiatusRAT Malware: What You Need to Know

Recent reports highlight a shift in focus of the HiatusRAT malware attacks, which now target the U.S. Department of Defense's server. Analysts recognize this as a reconnaissance mission.

Previously, the main targets of these attacks were businesses in Latin America and Europe, especially those using the DrayTek Vigor VPN routers. This VPN is popular among medium-sized companies to ensure remote access to their company networks.

However, a notable shift occurred from mid-June to August, as per insights from Lumen's Black Lotus Labs. During this period, the attackers also focused on a U.S. military procurement system and several organizations in Taiwan.

HiatusRAT Malware was adapted for various computer architectures such as Arm, Intel 80386, MIPS, MIPS64, and i386, and was stored on new virtual private servers (VPSs). One of these VPSs played a pivotal role in transferring data from a U.S. military website dedicated to contract proposals and submissions.

The very nature of the targeted website indicates that the attackers may have been after public information related to military needs or trying to pinpoint information on organizations linked to the Defense Industrial Base (DIB).

Lumen's Black Lotus Labs commented, "We believe the primary goal of the attackers was to gather public information about military contracts and identify DIB-related organizations for future attacks."

HiatusRAT Malware campaign is not isolated. Previously, over a hundred businesses across Europe, North and South America faced these malware attacks, resulting in the creation of a secret proxy network. This malware’s main function is to introduce more payloads into infected devices and transform these systems into SOCKS5 proxies, aiding in their command and control server communications.

Lumen noted, "Despite earlier exposures of their tools and tactics, the attackers made only superficial changes, continuing with their mission without revamping their command and control setup."

By understanding such attacks, businesses and organizations can enhance their cybersecurity measures, making the online world a safer place for all.

Protect Your Business Today

Petronella Technology Group has provided cybersecurity, compliance, and managed IT services from Raleigh, NC for over 23 years. Contact us today for a free consultation and technology assessment.