‘Horns&Hooves’ Malware Campaign Hits Over 1,000 Victims

A malware campaign targeting Russian retailers and service businesses since March 2023 aims to deploy remote access tools and install infostealer malware, warns Kaspersky.

A cybercriminal gang tracked as TA569 – also as Mustard Tempest and Gold Prelude – has been using phishing emails impersonating requests for quotes or proposals, with malicious JavaScript or HTA scripts embedded in zip archives.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Kaspersky dubs the campaign “Horns&Hooves” after a fake organization set up by fraudsters in the 1931 Soviet satirical novel “The Little Golden Calf.” The operation targeted more than 1,000 victims across Russia to deliver NetSupport RAT and BurnsRAT.

These phishing emails masquerade as legitimate correspondence, such as purchase requests or refund claims, with filenames designed to appear credible, such as “Request for price and proposal” or “Letter of claim.” .

Once executed, phshing email malicious scripts install NetSupport Manager, often weaponized as NetSupport RAT or BurnsRAT, granting attackers remote access and control over infected systems. The ultimate objective of these attacks is to exploit the Trojans’ access to deploy stealer malware like Rhadamanthys and Meduza.

Early Horns&Hooves attacks used HTA scripts that downloaded decoy documents, such as PNG files, alongside malware. These decoys, including screenshots of purchase tables or meaningless generated text, distract victims while the scripts install payloads. Later variants deployed JavaScript files and introduced intermediary scripts that downloaded additional components, including malicious BAT scripts and disguised decoy documents.

In one instance during the early stages of the campaign, attackers used an HTML Application file, when executed would download a decoy PNG image from a remote server using the curl utility for Windows. But while the image was being fetched, the HTA file retrieved and rans another script, bat_install.bat, from a different server using the BITSAdmin command-line tool. This script downloaded additional malicious files, including the NetSupport RAT malware, which established a connection to a command-and-control server controlled by the attackers.

The payloads are stored in inconspicuous directories, such as %APPDATA%VCRuntimeSync, with autorun registry entries ensuring persistence.

BurnsRAT, a variant of the Remote Manipulator System, is a sophisticated addition to the malware arsenal. Delivered via a DLL side-loading technique, attackers can establish remote desktop connections, execute commands and transfer files.

The malware encrypts data before exfiltration, using algorithms like RC4 for secure communication with C2 servers.