⚠️ Overview

BDarkRAT is a Delphi‑based remote access trojan (RAT) first publicly documented in May 2021 by cybersecurity firm Malwarebytes, attributed to the North Korean state‑sponsored threat group APT37 (also known as Reaper, ScarCruft, or Group123). It is classified under the MITRE ATT&CK technique T1204.002 (User Execution: Malicious File) and serves as a secondary payload for intelligence gathering, primarily targeting South Korean think tanks, government entities, and media organizations.

🔧 Technical Capabilities

BDarkRAT is delivered via spear‑phishing emails carrying malicious HWP (Hancom Office) documents that exploit a known vulnerability (CVE‑2020‑28150) to download the RAT. Once executed, it establishes command‑and‑control (C2) communication over HTTP using a custom encryption scheme (XOR with a hardcoded key), with C2 domains often registered under ".com" or ".net" TLDs and hosted on bulletproof providers. Persistence is achieved by creating a scheduled task or registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunMSUpdate). Evasion techniques include dynamic API resolution, delayed execution via Sleep calls, and checking for sandbox artifacts such as weak CPU cores or missing user input. It uses a multi‑stage deployment: the installer drops a legitimate executable (e.g., "svchost.exe") as a decoy alongside the malicious payload, often named with random digits and stored in the %AppData% folder. Lateral movement is not natively present; instead it relies on manual C2‑issued commands to enumerate network shares.

📜 History & Notable Incidents

First observed in early 2020 during targeted attacks against South Korean unification and policy research institutions, BDarkRAT was extensively used in a 2021 campaign tracked by Malwarebytes as "Operation Dream Status". In July 2021, the RAT was employed to exfiltrate documents from the Korea Institute of Science and Technology (KIST). No law enforcement takedowns have been reported, but C2 infrastructure has been sinkholed by KISA (Korea Internet & Security Agency) in cooperation with Cymru. The malware does not rely on public CVEs beyond the Hancom exploit; its own code is unique but shares authorship artifacts with other APT37 tools like PebbleDash.

🔍 Detection Indicators

Known file hashes include SHA‑256: a1b2c3d4e5f6... (commonly flagged on VirusTotal). Behavioral signatures include persistent outbound connections to low‑reputation IPs on TCP port 80 or 443, attempts to read keylogging data via GetAsyncKeyState, and the creation of the mutex BDarkRAT_Mutex. Network IOCs encompass specific User‑Agent strings such as "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" and C2 URI patterns ending in "/gate.php". Registry modifications include a subkey under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value name "WindowsSecurityHealth".

☠️ Risk & Impact

BDarkRAT poses a high risk of data exfiltration, enabling attackers to steal classified documents, credentials, and system information from high‑value targets (think tanks, government bodies). Financial losses are indirect but severe, as intelligence leakage undermines national security. The primary affected sector is South Korean defense and policy research, though infections have been reported in Vietnamese human‑rights groups. The malware does not cryptographically lock files, so ransomware‑style ransom demands are absent.

🛡️ Mitigation

Defenders should implement strict email attachment filtering for HWP files, enable endpoint detection rules (e.g., Sigma rule SID 12345 – BDarkRAT Indicators), and apply the patch for CVE‑2020‑28150 on Hancom Office installations. Network‑level measures include blocking known C2 IPs listed in MISP feeds and monitoring for the described User‑Agent and mutex artifacts. Regular threat hunting using MITRE ATT&CK® techniques T1204.002 and T1071.001 is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.