Ankura CTIX FLASH Update - December 8, 2023

Ransomware/Malware Activity

New Linux Remote Access Trojan "Krasue" Targets Thai Telecom Sector

A newly discovered Remote Access Trojan (RAT) for Linux has been seen targeting telecommunications firms in Thailand as reported by Group-IB. Named RAT Krasue in reference to a Thai nocturnal spirit, this malware is quite dangerous to those networks it has infected. What is notable about this RAT is that it has been undetected on the infected networks since 2021, much longer than many campaigns are capable of. It has been able to accomplish this through a multitude of factors, some of which include UPX packing to both obfuscate the code and make the size of the malware smaller. It can also run itself as a background process and install additional rootkits based on the user's permissions. Additionally, it uses fake metadata to rename itself as various VMWare applications and programs to further avoid suspicion. RAT Krasue uses a designated IP as the master