{"id":623,"date":"2024-05-27T23:37:28","date_gmt":"2024-05-27T23:37:28","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=623"},"modified":"2024-05-27T23:37:28","modified_gmt":"2024-05-27T23:37:28","slug":"red-akodon-a-new-threat-actor-distributing-rat-to-colombia","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2024\/05\/27\/red-akodon-a-new-threat-actor-distributing-rat-to-colombia\/","title":{"rendered":"Red Akodon, a new threat actor distributing RAT to Colombia"},"content":{"rendered":"

\"\"<\/h1>\n

<\/a>Overview<\/h1>\n

The purpose of this report is to highlight a new threat actor that SCILabs identified and profiled during April 2024. This actor has been observed impersonating organizations, primarily government entities from Colombia.\u00a0The information and indicators of compromise were obtained\u00a0through threat-hunting activities, malware analysis, and intelligence processes in public and private sources.<\/p>\n

Due to its behavior and characteristics, SCILabs named it Red Akodon<\/em>. This threat actor targets users of all types in Colombia, including public and private organizations employees, to steal confidential information such as bank accounts details, e-mail accounts, social media credentials, and access to corporate portals, among others, using remote access trojans (RAT<\/a>) like RemcosRAT<\/em><\/a>, QasarRat<\/em><\/a>, AsyncRAT<\/em><\/a>, and, XWorm<\/em><\/a>. Red Akodon<\/em>‘s initial access vector occurs mainly using phishing emails, which are used as a pretext for alleged lawsuits and judicial summonses, apparently coming from Colombian institutions such as the Fiscal\u00eda General de la Naci\u00f3n<\/em> and Juzgado 06 civil del circuito de Bogot\u00e1<\/em>.<\/p>\n

According to SCILabs\u2019 research, Red Akodon<\/em> has operated mainly in Colombia since April 2024, gradually increasing its activity since its first appearance. It has made small but constant changes to its infrastructure (such as its command-and-control servers or its malware download) and has used TTP to evade security solutions and make it difficult for cyber threat researchers to analyze.<\/a><\/p>\n

 <\/p>\n

<\/a>Region of operation<\/h1>\n

After conducting threat hunting and intelligence processes on public and private sources, SCILabs determined with a high confidence level that Red Akodon<\/em> attacks have primarily affected Colombia.<\/p>\n

To date, no campaigns have been identified affecting another region of LATAM or the world; however, SCILabs has the hypothesis, based on experience, that it is highly likely that this threat actor will spread the distribution of its campaigns to other Latin American countries in the future.<\/p>\n

The following map shows Red Akodon<\/em>‘s main operating region (highlighted in red), and its future potential target countries (highlighted in green).<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 1. Red Akodon’s<\/em> operating region<\/strong><\/p>\n

 <\/p>\n

Below is the chronology of the most relevant activity of Red Akodon<\/em>, according to the campaigns identified by SCILabs during April 2024. It is\u00a0important\u00a0to mention that, over time, the infrastructure and artifacts operated by this threat actor have experienced constant changes. Thus, for the following example\u00a0the most outstanding activity observed so far was considered.<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 2. Red Akodon’s<\/em> most relevant activity<\/strong><\/p>\n

 <\/p>\n

<\/a>Who is affected?<\/h1>\n

During the investigation, SCILabs identified that this threat actor’s campaigns primarily target Colombia. Although it did not appear to target any specific sector, it may affect public and private organizations of any industry, for example:<\/p>\n