Last year ESET published a blogpost about AceCryptor – one of the most popular and prevalent cryptors-as-a-service (CaaS) operating since 2016. For H1 2023 we published statistics from our telemetry, according to which trends from previous periods continued without drastic changes.However, in H2 2023 we registered a significant change in how AceCryptor is used. Not only we have seen and blocked over double the attacks in H2 2023 in comparison with H1 2023, but we also noticed that Rescoms (also known as Remcos) started using AceCryptor, which was not the case beforehand.The vast majority of AceCryptor-packed Rescoms RAT samples were used as an initial compromise vector in multiple spam campaigns targeting European countries including Poland, Slovakia, Bulgaria, and Serbia.Key points of this blogpost:AceCryptor continued to provide packing services to tens of very well-known malware families in H2 2023.Even though well known by security products, AceCryptor’s prevalence is not showing indications of decline: on the contrary, the number of attacks significantly increased due to the Rescoms campaigns.AceCryptor is a cryptor of choice of threat actors targeting specific countries and targets (e.g., companies in a particular country).In H2 2023, ESET detected multiple AceCryptor+Rescoms campaigns in European countries, mainly Poland, Bulgaria, Spain, and Serbia.The threat actor behind those campaigns in some cases abused compromised accounts to send spam emails in order to make them look as credible as possible.The goal of the spam campaigns was to obtain credentials stored in browsers or email clients, which in case of a successful compromise would open possibilities for further attacks.AceCryptor in H2 2023In the first half of 2023 ESET protected around 13,000 users from AceCryptor-packed malware. In the second half of the year, there was a massive increase of AceCryptor-packed malware spreading in the wild, with our detections tripling, resulting in over 42,000 protected ESET users worldwide. As can be observed in Figure 1, we detected multiple sudden waves of malware spreading. These spikes show multiple spam campaigns targeted at European countries where AceCryptor packed a Rescoms RAT (discussed more in the Rescoms campaigns section).Figure 1. Number of AceCryptor detections during the year 2023 (7-day moving average)Furthermore, when we compare the raw number of samples: in the first half of 2023, ESET detected over 23,000 unique malicious samples of AceCryptor; in the second half of 2023, we saw and detected “only” over 17,000 unique samples. Even though this might be unexpected, after a closer look at the data there is a reasonable explanation. The Rescoms spam campaigns used the same malicious file(s) in email campaigns sent to a greater number of users, thus increasing the number of people who encountered the malware, but still keeping the number of different files low. This did not happen in previous periods as Rescoms was almost never used in combination with AceCryptor. Another reason for the decrement in the number of unique samples is because some popular families apparently stopped (or almost stopped) using AceCryptor as their go-to CaaS. An example is Danabot malware which stopped using AceCryptor; also, the prominent RedLine Stealer whose users stopped using AceCryptor as much, based on a greater than 60% decrease in AceCryptor samples containing that malware.As seen in Figure 2, AceCryptor still distributes, apart from Rescoms, samples from many different malware families, such as SmokeLoader, STOP ransomware, and Vidar stealer.Figure 2. Malware families packed inside AceCryptor in H2 2023In the first half of 2023, the countries most affected by malware packed by AceCryptor were Peru, Mexico, Egypt, and Türkiye, where Peru, at 4,700, had the greatest number of attacks. Rescoms spam campaigns changed these statistics dramatically in the second half of the year. As can be seen in Figure 3, AceCryptor-packed malware affected mostly European countries. By far the most affected country is Poland, where ESET prevented over 26,000 attacks; this is followed by Ukraine, Spain, and Serbia. And, it’s worth mentioning that in each of those countries ESET products prevented more attacks than in the most affected country in H1 2023, Peru.Figure 3. Heatmap of countries affected by AceCryptor, according to ESET telemetryAceCryptor samples that we’ve observed in H2 often contained two malware families as their payload: Rescoms and SmokeLoader. A spike in Ukraine was caused by SmokeLoader. This fact was already mentioned by Ukraine’s NSDC. On the other hand, in Poland, Slovakia, Bulgaria, and Serbia the increased activity was caused by AceCryptor containing Rescoms as a final payload.Rescoms campaignsIn the first half of 2023, we saw in our telemetry fewer than a hundred incidents of AceCryptor samples with Rescoms inside. During the second half of the year, Rescoms became the most prevalent malware family packed by AceCryptor, with over 32,000 hits. Over half of these attempts happened in Poland, followed by Serbia, Spain, Bulgaria, and Slovakia (Figure 4).Figure 4. Heatmap of European countries affected by AceCryptor-packed Rescoms during H2 2023, according to ESET telemetryCampaigns in PolandThanks to ESET telemetry we’ve been able to observe eight significant spam campaigns targeting Poland in H2 2023. As can be seen in Figure 5, the majority of them happened in September, but there were also campaigns in August and December.Figure 5. Timeline of Rescoms campaigns in Poland (daily hits)In total, ESET registered over 26,000 of these attacks in Poland for this period. All spam campaigns targeted businesses in Poland and all emails had very similar subject lines about B2B offers for the victim companies. To look as believable as possible, the attackers incorporated the following tricks into the spam emails:Email addresses they were sending spam emails from imitated domains of other companies. Attackers used a different TLD, changed a letter in a company name or the word order in the case of a multi-word company name (this technique is known as typosquatting).The most noteworthy is that multiple campaigns involved business email compromise – attackers abused previously compromised email accounts of other company employees to send spam emails. In this way even if the potential victim looked for the usual red flags, they were just not there, and the email looked as legitimate as it could have.Attackers did their research and used existing Polish company names and even existing employee/owner names and contact information when signing those emails. This was done so that in the case where a victim tries to Google the sender’s name, the search would be successful, which might lead them to open the malicious attachment.The content of spam emails was in some cases simpler but in many cases (like the example in Figure 6) quite elaborate. Especially these more elaborate versions should be considered dangerous as they deviate from the standard pattern of generic text, which is often riddled with grammatical mistakes.The email shown in Figure 6 contains a message followed by information about the processing of personal information done by the alleged sender and the possibility to “access the content of your data and the right to rectify, delete, limit processing restrictions, right to data transfer, right to raise an objection, and the right to lodge a complaint with the supervisory authority”. The message itself can be translated thus:Dear Sir,I am Sylwester [redacted] from [redacted]. Your company was recommended to us by a business partner. Please quote the attached order list. Please also inform us about the payment terms.We look forward to your response and further discussion.--Best Regards,Figure 6. Example phishing email targeting Polish companies, containing AceCryptor-packed Rescoms in the attachmentAttachments in all campaigns looked quite similar (Figure 7). Emails contained an attached archive or ISO file named offer/inquiry (of course in Polish), in some cases also accompanied with an order number. That file contained an AceCryptor executable that unpacked and launched Rescoms.Figure 7. Compromise chain of Rescoms campaignsBased on the behavior of the malware, we assume that the goal of these campaigns was to obtain email and browser credentials, and thus gain initial access to the targeted companies. While it is unknown whether the credentials were gathered for the group that carried out these attacks or if those stolen credentials would be later sold to other threat actors, it is certain that successful compromise opens the possibility for further attacks, especially from, currently popular, ransomware attacks.It is important to state that Rescoms RAT can be bought; thus many threat actors use it in their operations. These campaigns are not only connected by target similarity, attachment structure, email text, or tricks and techniques used to deceive potential victims, but also by some less obvious properties. In the malware itself, we were able to find artifacts (e.g., the license ID for Rescoms) that tie those campaigns together, revealing that many of these attacks were carried out by one threat actor.Campaigns in Slovakia, Bulgaria, and SerbiaDuring the same time periods as the campaigns in Poland, ESET telemetry also registered ongoing campaigns in Slovakia, Bulgaria, and Serbia. These campaigns also mainly targeted local companies and we can even find artifacts in the malware itself tying these campaigns to the same threat actor that carried out the campaigns in Poland. The only significant thing that changed was, of course, the language used in the spam emails to be suitable for those specific countries.Campaigns in SpainApart from previously mentioned campaigns, Spain also experienced a surge of spam emails with Rescoms as the final payload. Even though we can confirm that at least one of the campaigns was carried out by the same threat actor as in these previous cases, other campaigns followed a somewhat different pattern. Furthermore, even artifacts that were the same in previous cases differed in these and, because of that, we cannot conclude that the campaigns in Spain originated from the same place.ConclusionDuring the second half of 2023 we detected a shift in the usage of AceCryptor – a popular cryptor used by multiple threat actors to pack many malware families. Even though the prevalence of some malware families like RedLine Stealer dropped, other threat actors started using it or used it even more for their activities and AceCryptor is still going strong.In these campaigns AceCryptor was used to target multiple European countries, and to extract information or gain initial access to multiple companies. Malware in these attacks was distributed in spam emails, which were in some cases quite convincing; sometimes the spam was even sent from legitimate, but abused email accounts. Because opening attachments from such emails can have severe consequences for you or your company, we advise that you be aware about what you are opening and use reliable endpoint security software able to detect the malware.For any inquiries about our research published on WeLiveSecurity, please contact us at threatintel@eset.com.ESET Research offers private APT intelligence reports and data feeds. For any inquiries about this service, visit the ESET Threat Intelligence page.IoCsA comprehensive list of Indicators of Compromise (IoCs) can be found in our GitHub repository.FilesSHA-1FilenameDetectionDescription7D99E7AD21B54F07E857FC06E54425CD17DE3003PR18213.isoWin32/Kryptik.HVOBMalicious attachment from spam campaign carried out in Serbia during December 2023.7DB6780A1E09AEC6146ED176BD6B9DF27F85CFC1zapytanie.7zWin32/Kryptik.HUNXMalicious attachment from spam campaign carried out in Poland during September 2023.7ED3EFDA8FC446182792339AA14BC7A83A272F8520230904104100858.7zWin32/Kryptik.HUMXMalicious attachment from spam campaign carried out in Poland and Bulgaria during September 2023.9A6C731E96572399B236DA9641BE904D142F155620230904114635180.isoWin32/Kryptik.HUMXMalicious attachment from spam campaign carried out in Serbia during September 2023.57E4EB244F3450854E5B740B95D00D18A535D119SA092300102.isoWin32/Kryptik.HUPKMalicious attachment from spam campaign carried out in Bulgaria during September 2023.178C054C5370E0DC9DF8250CA6EFBCDED995CF09zamowienie_135200.7zWin32/Kryptik.HUMIMalicious attachment from spam campaign carried out in Poland during August 2023.394CFA4150E7D47BBDA1450BC487FC4B970EDB35PRV23_8401.isoWin32/Kryptik.HUMFMalicious attachment from spam campaign carried out in Serbia during August 2023.3734BC2D9C321604FEA11BF550491B5FDA804F70BP_50C55_20230309_094643.7zWin32/Kryptik.HUMFMalicious attachment from spam campaign carried out in Bulgaria during August 2023.71076BD712C2E3BC8CA55B789031BE222CFDEEA720_J402_MRO_EMSWin32/Rescoms.BMalicious attachment from spam campaign carried out in Slovakia during August 2023.667133FEBA54801B0881705FF287A24A874A400B736037763.isoWin32/Rescoms.BMalicious attachment from spam campaign carried out in Bulgaria during December 2023.AF021E767E68F6CE1D20B28AA1B36B6288AFFFA5zapytanie ofertowe.7zWin32/Kryptik.HUQFMalicious attachment from spam campaign carried out in Poland during September 2023.BB6A9FB0C5DA4972EFAB14A629ADBA5F92A50EAC129550.7zWin32/Kryptik.HUNCMalicious attachment from spam campaign carried out in Poland during September 2023.D2FF84892F3A4E4436BEDC221102ADBCAC3E23DCZamowienie andre.7zWin32/Kryptik.HUOZMalicious attachment from spam campaign carried out in Poland during September 2023.DB87AA88F358D9517EEB69D6FAEE7078E603F23C20030703_S1002.isoWin32/Kryptik.HUNIMalicious attachment from spam campaign carried out in Serbia during September 2023.EF2106A0A40BB5C1A74A00B1D5A6716489667B4CZamowienie_830.isoWin32/Kryptik.HVOBMalicious attachment from spam campaign carried out in Poland during December 2023.FAD97EC6447A699179B0D2509360FFB3DD0B06BFlista zamówień i szczegółowe zdjęcia.arjWin32/Kryptik.HUPKMalicious attachment from spam campaign carried out in Poland during September 2023.FB8F64D2FEC152D2D135BBE9F6945066B540FDE5Pedido.isoWin32/Kryptik.HUMFMalicious attachment from spam campaign carried out in Spain during August 2023.MITRE ATT&CK techniquesThis table was built using version 14 of the MITRE ATT&CK framework.TacticIDNameDescriptionReconnaissanceT1589.002Gather Victim Identity Information: Email AddressesEmail addresses and contact information (either bought or gathered from publicly available sources) were used in phishing campaigns to target companies across multiple countries.Resource DevelopmentT1586.002Compromise Accounts: Email AccountsAttackers used compromised email accounts to send phishing emails in spam campaigns to increase spam email’s credibility.T1588.001Obtain Capabilities: MalwareAttackers bought and used AceCryptor and Rescoms for phishing campaigns.Initial AccessT1566PhishingAttackers used phishing messages with malicious attachments to compromise computers and steal information from companies in multiple European countries.T1566.001Phishing: Spearphishing AttachmentAttackers used spearphishing messages to compromise computers and steal information from companies in multiple European countries.ExecutionT1204.002User Execution: Malicious FileAttackers relied on users opening and launching malicious files with malware packed by AceCryptor.Credential AccessT1555.003Credentials from Password Stores: Credentials from Web BrowsersAttackers tried to steal credential information from browsers and email clients.
