Grewapacha

GrewApacha is a Remote Access Trojan (RAT) that has been used by Advanced Persistent Threat group 31 (APT31), also known as EastWind, since 2021. It is a type of malware designed to infiltrate systems undetected, enabling the attacker to control the infected device remotely. The GrewApacha Trojan can be identified by searching for an unsigned file named 'msedgeupdate.dll' in the system's file structure. Notably, the loader for this RAT has remained unchanged since its initial discovery, with only minor differences introduced to the RAT itself over time. This malware is part of a broader attack strategy involving multiple malicious tools. In addition to GrewApacha, attackers have also been found to download the CloudSorcerer backdoor onto compromised systems. This multi-pronged approach increases the potential for damage and exploitation. The malware set bears resemblance to the "sideloading triad" typically associated with attacks involving PlugX, another well-known piece of malware. Kaspersky has labeled the APT31 malware used in EastWind's campaign as "GrewApacha." This indicates a connection between different China-nexus actors, suggesting coordinated or related cyber activity. Despite the similarities with other attacks, analysis of the files associated with GrewApacha confirms that it is a unique RAT attributed to the APT31 group. This underscores the ongoing threat posed by APT31 and the need for continued vigilance and robust cybersecurity measures.