Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)

What Happened

A cybersecurity research team has identified an ongoing hacking campaign targeting users in South Korea with a powerful backdoor program called Xctdoor. The hackers, believed to be connected to North Korea's Lazarus group, trick victims into opening malicious files disguised as legitimate documents or security software installers. Once activated, the malware installs itself deeply into the system, steals information like keystrokes and screenshots, and allows the attackers to remotely control the infected computer. The researchers discovered that this malware is connected to an older threat called CRAT, which has been used since 2020 alongside ransomware attacks. Organizations and individuals in Korea, especially those using Korean software, should be cautious of email attachments and programs from untrusted sources, and ensure their security software is up to date.

Key Takeaways

• Larva-26005 threat actor, linked to North Korea's Lazarus group, is actively distributing Xctdoor backdoor to Korean users via spear phishing and disguised security software installers
• Xctdoor is directly connected to CRAT malware (active since 2020), sharing identical code obfuscation routines, AppX package installation paths, and historical use alongside Hansom ransomware
• Attack chain employs DLL side-loading via legitimate executables (ShellRunAs, wkspbroker.exe), multi-stage script downloaders (VBS/BAT/PS1), and process injection through RegSvr32
• Xctdoor supports extensive C2 capabilities including shell sessions, keylogging, screenshots, file upload/download, process management, and in-memory payload injection
• Both C++ and Go variants of Xctdoor identified with identical command structures (0x10001-0x10029) and user absence monitoring (screensaver/monitor lock/session lock)

Affected Systems

• Windows operating systems (endpoints and servers)
• Windows IIS web servers (compromised for web shell deployment)
• Korean ERP solutions (patched to execute malware for persistence)
• BeeBEEP open-source messenger (installer modified to spread malware internally)
• Veraport security software (impersonated as disguise)
• SoftCamp security software (impersonated as disguise)

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Spear phishing emails with LNK files or disguised security software installers (Veraport/SoftCamp) delivered to Korean users
2. Execution: DLL side-loading via legitimate executables (ShellRunAs renamed to veraport-q3.exe, wkspbroker.exe renamed to SCWSSPSetup.exe) loads malicious DLLs (credui.Dll, RADCUI.Dll)
3. Scripting: Dropper creates VBS launcher, BAT downloader, and VBS downloader in %PUBLIC%\videos; BAT downloads encrypted Xctdoor and XcLoader, VBS downloads PowerShell launcher
4. Defense Evasion: PowerShell launcher XOR-decrypts payloads and moves them to AppX package Settings directory; XcLoader uses same XOR algorithm (Data ^ 0x11 ^ ((i * i) mod 0xFF))
5. Persistence: RegSvr32 executes XcLoader (settings.Lock) which creates startup shortcut; CRAT historically used Run key with LNK+RegSvr32
6. C2 and Exfiltration: XcLoader injects Xctdoor (roaming.Dat) into legitimate processes (explorer.exe by default); Xctdoor establishes C2 for shell sessions, keylogging, screenshots, file exfiltration, and process management

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article is an analytical report and does not include any detection rules, queries, or signatures. Additional IOCs and detailed analysis are available through AhnLab TIP subscription.

Detection Engineering Assessment

Required Log Sources

• Windows Sysmon Event ID 1 (Process Creation)
• Windows Sysmon Event ID 7 (Image Loaded - DLL loading)
• Windows Sysmon Event ID 11 (File Creation)
• Windows Sysmon Event ID 8 (Remote Thread Creation - for injection detection)
• Windows Security Event ID 4688 (Process Creation)
• Scheduled Task logs (Microsoft-Windows-TaskScheduler/Operational)
• PowerShell Script Block Logging (Event ID 4104)
• Network connection logs (Sysmon Event ID 3 or firewall logs)

Hunting Hypotheses

Control Gaps

• Static signature-based AV may miss Xctdoor due to runtime code obfuscation and continuous re-encryption of the payload file with changing XOR keys
• Network-based detection may miss C2 traffic if it uses standard HTTP and blends with legitimate web traffic
• Application whitelisting may not prevent execution since the attack chain uses legitimate system binaries (RegSvr32, ShellRunAs, wkspbroker.exe)
• DLL side-loading bypasses controls that focus on executable reputation since the initial executable is legitimate

Key Behavioral Indicators

• RegSvr32 loading DLLs from %LOCALAPPDATA%\Packages\Microsoft.MicrosoftOffice365Hub_8wekyb3d8bbwe\Settings\ directory
• Script files (.vbs, .bat, .ps1) created and executed from %PUBLIC%\videos\ directory
• XOR decryption pattern: (Data ^ 0x11 ^ ((i * i) mod 0xFF)) used for payload decryption in both PowerShell and XcLoader
• Process injection into explorer.exe by default when settings.ini configuration file is absent
• Files named roaming.Dat and settings.Lock in AppX package Settings directories
• DLL side-loading with renamed legitimate executables (veraport-q3.exe, SCWSSPSetup.exe) loading malicious DLLs (credui.Dll, RADCUI.Dll)
• Named pipe \.\Pipe\ChromeUpdatePipe used for inter-process payload delivery (CRAT)
• Shared memory name SM3:2300:402:WilStaging_01 created by Xctdoor for data storage
• User absence monitoring via screensaver state, monitor display status, and session lock state

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether Windows IIS web servers in your environment have unnecessary upload functionality exposed externally, as this was identified as an initial breach vector in 2024 attack cases.
• Consider implementing application directory DLL whitelisting to prevent DLL side-loading attacks using renamed legitimate executables.
• If applicable, consider monitoring and restricting access to Korean ERP solution update mechanisms, as these were exploited for persistence and internal malware distribution.
• Evaluate whether Ngrok or similar tunneling tools are restricted in your environment, as the threat actor used Ngrok to expose NAT-internal systems.

User Protection

• Consider deploying endpoint controls that detect and alert on script execution from %PUBLIC% directories, if supported by your EDR or endpoint protection platform.
• If your organization uses Veraport or SoftCamp security software, consider verifying the integrity of installation packages and distribution channels.
• Consider enabling PowerShell Script Block Logging (Event ID 4104) if not already deployed, to capture the XOR decryption and file movement commands used in the attack chain.

Security Awareness

• Consider incorporating into existing awareness programs guidance about the specific spear phishing themes used by this actor: investment, real estate transactions, sales documents, security notices, and account statements.
• Consider reminding users that LNK files can execute commands invisibly and should be treated with the same caution as executable files.
• If applicable to your workforce, consider awareness training about the risk of downloading software from community sites and untrusted sources, as CRAT was distributed via uploads to Korean community sites.

MITRE ATT&CK Mapping

Additional IOCs

• Domains:
  • casinolegit[.]fun - Malicious domain associated with Larva-26005 campaign infrastructure
  • koramate[.]fun - Malicious domain associated with Larva-26005 campaign infrastructure
  • ntsgo-corp[.]com - Malicious domain associated with Larva-26005 campaign infrastructure
  • ntsgo[.]name - Malicious domain associated with Larva-26005 campaign infrastructure
  • www[.]fabioluciani[.]com - C2 server address for downloader malware used by Lazarus group, referenced in Kaspersky ThreatNeedle and Google TAG reports
• Urls:
  • hxxp://casinolegit[.]info/ms/beeLogo.webp - Malicious URL associated with Larva-26005 campaign infrastructure
  • hxxp://casinosec[.]info/ms/beeLogo.webp - Malicious URL associated with Larva-26005 campaign infrastructure
  • hxxp://cristiantirira[.]com/wp-content/uploads/2018/11/03-499×300.png - Malicious URL associated with Larva-26005 campaign infrastructure
  • hxxp://desk-azureft[.]info/wp-include/wpmain.php - Malicious URL associated with Larva-26005 campaign infrastructure
  • hxxp://grace2019[.]teamernst[.]net/wp-content/uploads/2011/08/student_2141-800×200.jpg - Malicious URL associated with Larva-26005 campaign infrastructure
• Registry Keys:
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run - Run key used by CRAT to register LNK file that executes malware via RegSvr32 for persistence
• File Paths:
  • %PUBLIC%\videos\ - Directory where dropper creates VBS launcher, BAT downloader, VBS downloader, and PS1 launcher scripts
  • %LOCALAPPDATA%\Packages\Microsoft.MicrosoftOffice365Hub_8wekyb3d8bbwe\Settings\roaming.Dat - Installation path for encrypted Xctdoor backdoor payload, moved here by PowerShell launcher from %PUBLIC%\Pictures
  • %LOCALAPPDATA%\Packages\Microsoft.MicrosoftOffice365Hub_8wekyb3d8bbwe\Settings\settings.Lock - Installation path for XcLoader injector, XOR-decoded and moved here by PowerShell launcher; executed via RegSvr32
  • %ALLUSERSPROFILE%\msci.Cng - File storing data used in Xctdoor communication packet headers; reset by backdoor command 0x10025
  • %LOCALAPPDATA%\microsoft\windowsapps\microsoft.Microsoftedge_8wekyb3d8bbwe\ - AppX package path used by CRAT for installation since 2020; also used by early Xctdoor variants
• Command Lines:
  • Purpose: Execute XcLoader injector DLL via RegSvr32 for persistence and Xctdoor injection | Tools: regsvr32.exe | Stage: Execution and Persistence | regsvr32.exe /s %LOCALAPPDATA%\Packages\<AppXPackage>\Settings\settings.Lock
  • Purpose: Multiple command execution capability provided by Xctdoor backdoor via C2 command 0x10021 | Tools: cmd.exe | Stage: C2 Command Execution | cmd /c <command>
• Other:
  • \\.\Pipe\ChromeUpdatePipe - Named pipe used by CRAT to communicate with co-installed injector module for payload delivery to legitimate processes
  • SM3:2300:402:WilStaging_01 - Shared memory name created by Xctdoor command 0x10026 for inter-process data storage
  • [email protected] - Secondary Hansom ransomware contact email address used in historical CRAT+Hansom attack cases