Witchetty Group Uses Steganography To Target Middle East Entities

New tools and techniques

• The use of the steganography technique enables attackers to conceal the malicious payload in a bitmap image of an old Microsoft Windows logo hosted on a GitHub repository.
• Other new custom tools used by the attackers include a proxy utility, a port scanner, and a persistence utility. 
• In addition, experts observed many other tools and malware such as Plink, a keylogger, LSASS credential stealer, Mimikatz, China Chopper, and Korplug/PlugX loader.

Attack targets

• Witchetty’s attacks were broadly targeting governments, diplomatic missions, charities, and industrial/manufacturing organizations in the Middle East and Africa.
• Between February and September 2022, Witchetty specifically launched attacks against the governments of two Middle Eastern countries and the stock exchange of an African nation.

Differences from the past

• In April 2022, Witchetty was exploiting RCE vulnerabilities in popular server applications and making use of available exploit to gain control of unpatched servers.
• Witchetty was earlier using a first-stage backdoor dubbed X4 and a second-stage modular malware known as LookBack, while now it has switched to the backdoor Trojan named Backdoor.Stegmap.

Summing up