AllaKore RAT: The Trojan Horse Targeting Mexico’s Financial Titans

In a cyber landscape increasingly dominated by sophisticated threats, a recent campaign was found targeting Mexican financial institutions and cryptocurrency trading platforms. This operation, driven by a financially motivated threat actor, utilizes a modified version of the open-source remote access tool, AllaKore RAT, to infiltrate and exploit its targets.

The attack commences with ingeniously crafted lures leveraging the Mexican Social Security Institute (IMSS) naming schemas, a tactic that lends an air of legitimacy to the malicious endeavors. These lures, embedded within custom-packaged installers, guide unsuspecting victims through an installation process that ultimately delivers the AllaKore RAT payload. This payload, significantly altered from its original form, is designed to siphon off banking credentials and unique authentication information back to a command-and-control (C2) server, setting the stage for financial fraud.

AllaKore RAT, a seemingly benign tool written in Delphi, has been around since 2015. However, its adaptation by the threat actor into a conduit for cyber espionage represents a significant shift in its application. The modified AllaKore RAT goes beyond its basic functionalities of keylogging and screen capturing, incorporating commands specifically tailored for banking fraud against Mexican banks and cryptocurrency platforms.

The campaign, as observed by the BlackBerry Threat Research & Intelligence Team, shows a marked indifference to the industry, targeting entities primarily for their financial heft, many of which report gross revenues exceeding $100M USD. The meticulous selection of targets underscores the threat actor’s intention: to infiltrate large companies capable of yielding substantial financial information.

The technical analysis of the campaign reveals a complex installation structure involving MSI files and a network of C2 infrastructure that points to a Latin American origin. The use of Spanish-language instructions within the modified RAT and the employment of Mexico Starlink IPs further corroborate the regional specificity of the threat actor’s operations.

This persistent targeting of Mexican entities over the past two years, facilitated by the AllaKore RAT, underscores a critical vulnerability in the cybersecurity defenses of large companies. The campaign’s longevity and the sophistication of its execution methods call for an urgent and coordinated response. Companies, especially those within the financial sector, must bolster their cybersecurity measures, employing advanced detection and response strategies to mitigate the risk posed by such targeted attacks.

The deployment of the AllaKore RAT in targeting Mexican banks and cryptocurrency trading entities marks a significant escalation in the threat landscape. This campaign not only highlights the adaptability and persistence of financially motivated threat actors but also serves as a cautionary tale for financial institutions worldwide. The need for vigilance, sophisticated cybersecurity protocols, and continuous monitoring has never been more critical in the fight against cybercrime.