Phishing Campaign Uses Maduro Arrest Story to Deliver Backdoor Payloads

Cybercriminals are leveraging the latest arrest of Venezuelan President Nicolás Maduro to distribute subtle backdoor malware.

The risk actors exploited information surrounding Maduro’s arrest on January 3, 2025, demonstrating how geopolitical occasions proceed to function efficient lures for malicious campaigns.

The assault doubtless begins with a spear-phishing e mail containing a zipper archive named “US now deciding what’s subsequent for Venezuela.zip”.

Inside, victims discover an executable file titled “Maduro to be taken to New York.exe” alongside a malicious dynamic-link library known as “kugou.dll”.

 DLL known as with LoadLibraryW

The executable is a legit KuGou binary, however has been weaponized by way of DLL hijacking to load the malicious library, in response to Darktrace safety researchers.

Malware Conduct

As soon as executed, the malware creates a listing at C:ProgramDataTechnology360NB and copies itself, renaming the information.

 Folder “Technology360NB” created

It establishes persistence by including a registry key at “HKCUSoftwareMicrosoftWindowsCurrentVersionRunLite360” that runs routinely at system startup.

The malware then shows a dialog field prompting customers to restart their laptop, which triggers the malicious payload.

Message field prompting consumer to restart

After the system restarts, the malware initiates common encrypted connections to a command-and-control server at 172.81.60[.]97 on port 443.

These periodic connections allow the malware to obtain directions and configurations from the attackers.

The marketing campaign shares similarities with earlier operations by Mustang Panda, a Chinese language risk group identified for exploiting present occasions such because the Ukraine battle, Tibet-related conventions, and Taiwan-related matters.

Nonetheless, researchers observe that there’s inadequate proof to attribute this exercise to any particular group definitively.

This incident highlights the continued risk of geopolitical-themed phishing campaigns.

Organizations and people ought to train excessive warning when opening e mail attachments, particularly these referencing breaking information or world occasions.

Indicators of Compromise (IoCs)

172.81.60[.]97

8f81ce8ca6cdbc7d7eb10f4da5f470c6 – US now deciding what’s subsequent for Venezuela.zip

722bcd4b14aac3395f8a073050b9a578 – Maduro to be taken to New York.exe

aea6f6edbbbb0ab0f22568dcb503d731  – kugou.dll

Comply with us on Google Information, LinkedIn, and X to Get Extra Prompt Updates, Set CSN as a Most well-liked Supply in Google.