Ankura CTIX FLASH Update - June 20, 2023

Malware Activity

Researchers Observe New Custom "RDStealer" Malware in the Highly Targeted "RedClouds" Campaign

"RDStealer," a new custom malware written in Golang, has been observed in a highly targeted cyber campaign tracked as "RedClouds," which has been ongoing since early 2022. This campaign has been targeting an East Asian company and has the goal of data exfiltration and credential theft. The campaign has yet to be attributed to a specific threat group, though researchers noted that the target aligns with "the interest of China-based threat actors" and has the sophistication of a state-sponsored actor. RDStealer is described as a server-side implant that takes advantage of the redirection feature in remote desktop servers. RDStealer monitors incoming remote desktop protocol (RDP) connections with client drive mapping enabled and, once clients are connected, infects them with the "Logutil" backdoor, and additional custom malware, as well as exfiltrates