Analysis Summary

Threat actors are using malicious scripts hidden in code from a Python clone of Microsoft's classic Minesweeper game to target financial institutions in the US and Europe.

Researchers identify the attacker as 'UAC-0188,' a threat actor who uses the bogus code to conceal Python scripts that download and install the SuperOps RMM. With the help of SuperOps RMM, a reliable remote management tool, remote actors can gain direct access to compromised systems. At least five possible breaches by the same files in financial and insurance institutions across Europe and the US were discovered at the time of the attack's initial disclosure.

The email that starts the attack looks like it comes from a medical facility and has the subject "Personal Web Archive of Medical Documents". The receiver is directed to the Dropbox link provided to download a 33 MB .SCR file. Innocuous code from a Python Minesweeper clone and malicious Python code that downloads further scripts from a remote site are both present in this file.

To make the 28MB base64-encoded string containing the malicious code appear benign to security tools, the executable's Minesweeper code is included as a cover for it. Furthermore, a method called "create_license_ver" is repurposed in the Minesweeper code to decode and execute the malicious code that is disguised. As a result, legitimate software components are utilized to facilitate and mask the cyberattack.

After the Base64 text is decoded, a ZIP file containing the SuperOps RMM MSI installer is assembled. This file is then extracted and run using a static password. In this instance, SuperOps RMM is utilized to give the attackers illegal access to the victim's computer, despite being a valid remote access program. Researchers warn that companies not utilizing the SuperOps RMM software should consider any mention of it or associated network activity—such as requests to the "superops.com" or "superops.ai" domains—as evidence of potential compromise.

Impact

• Unauthorized Access
• Security Bypass
• Code Execution
• Financial Loss

Indicators of Compromise

Domain Name

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Be vigilant when downloading software and double-check the URL to see if it is legitimate.
• Never download software from untrusted sources.
• Download apps only from official app stores like Google Play Store or Apple App Store. Avoid downloading apps from third-party websites or unofficial sources.
• Review the permissions requested by apps before installing them. Be cautious of apps that request unnecessary permissions or access to sensitive data.
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Keep your operating system and apps up-to-date with the latest security patches and updates.
• Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Be cautious of unsolicited messages, emails, or links, especially from unknown or suspicious sources. Avoid clicking on suspicious links or downloading attachments from untrusted sources.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Regularly backup your data to a secure location, such as a cloud storage service or external hard drive.
• Develop and regularly update an incident response plan that outlines the steps to take in case of a security breach. Test the plan through simulations to ensure its effectiveness.