Operation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
summary
Multiplatform espionage campaign targets online gambling customers in Southeast Asia using Windows, Linux and macOS malware; observed families include PlugX, Gh0stRAT, XNote, HelloBot and newly named GoRAT and PuppetRAT, one of which hides payloads in images. Infection vectors are backdoored or fake installers (an Electron “Mimi” chat app), injected persistent XSS feeding fake Flash installers, and a Bitget-branded macOS DMG. A five-stage puppet loader with a flawed RC4 swap bug links multiple samples; infrastructure spans ~50 C2 IPs, 150+ subdomains and 13+ malware families.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:18Introduction
- 2:54Infection vector - chat application
- 4:44Infection vector - XSS and fake installer
- 7:09Infection vector - DMG file
- 8:01Malware toolkit - Windows
- 15:20Malware toolkit - PuppetLoader
- 23:08Targets - Telemetry
- 23:56Targets Configuration files
- 24:50Infrastructure
- 30:28Takeaways
related talks
19mOperation PZCHAO
42mThe Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT
49mThe State Of Malware From The Eye Of The Tiger
31mHacking People’s Mind: When Threat Actors Master Social Engineering
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
17mRadRAT: An all-in-one toolkit for complex espionage ops
47mDetecting and analyzing files-less malware
10mSurfacing from the Underbrush: Machete Pivots to Intrusion-Enabled Info Ops