Redeyes

RedEyes, also known as APT37, StarCruft, Reaper, InkSquid, BadRAT, ScarCruft, and Ricochet Chollima, is a threat actor group known for its malicious activities. The group has recently deployed a new malware called FadeStealer to pilfer data from compromised systems, which it then sends to a command-and-control (C2) server. This malware, while not considered sophisticated, is designed to steal various types of information that can be used as stepping-stones for future attacks. RedEyes has been spreading these malicious emails related to Cambodian affairs, and in Cambodia's primary language, Khmer, to lure in targets. The group primarily targets specific individuals such as North Korean defectors, human rights activists, and university professors. In a recent campaign, they initiated their attacks through spear-phishing emails containing a Compiled HTML Help File (CHM) disguised as a password-protected document. Another strategy employed by the group includes the use of CloudMensis malware, which persistently attempts to identify where System Integrity Protection (SIP) is disabled to load its own malicious database. ASEC is actively monitoring the activities of the RedEyes group and taking steps to mitigate further damage. Despite the efforts of cybersecurity experts like Liang, who identified Lazarus Group malware attempting to dump the access table from the TCC database, the threat posed by RedEyes remains significant. The state-sponsored group continues to leverage novel malware distribution techniques to target vulnerable individuals and organizations.