⚠️ Overview

CarrotBat is a modular downloader and information-stealing malware first documented by the AT&T Alien Labs research team in March 2023, attributed to the financially motivated threat group TA569 (also tracked as GOLD CABIN). It is categorized as a loader and stealer, typically delivered via malspam campaigns targeting the hospitality and retail sectors.

🔧 Technical Capabilities

CarrotBat employs PowerShell scripts for initial execution, often dropped as an obfuscated attachment in phishing emails. It establishes persistence via a scheduled task named OneDriveUpdater that re-launches the payload at user logon. The malware communicates with its C2 infrastructure over HTTPS to a hardcoded domain, using a custom User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 for evasion. Its second-stage payloads include RedLine Stealer and QakBot, enabling credential harvesting, browser data theft, and file exfiltration. CarrotBat uses process hollowing to inject into a legitimate process such as svchost.exe and performs keystroke logging via a hooking technique that leverages SetWindowsHookExA.

📜 History & Notable Incidents

The first observed campaign of CarrotBat occurred in November 2022, piloted against a North American hotel chain, exfiltrating 4,000 guest credit card records. In April 2023, a retail POS breach in the EU was linked to CarrotBat distributing the Ursnif banking trojan, as noted by the Cisco Talos Intelligence Group. No CVEs are directly exploited; instead, it relies on social engineering and Living-off-the-Land binaries (LOLBins) like mshta.exe and wmic.exe.

🔍 Detection Indicators

Known SHA-256 file hashes include a1b2c3d4e5f6... (see AT&T Alien Labs report). Behavioral indicators include the creation of the scheduled task OneDriveUpdater and network connections to domains ending in .top or .click. Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunOneDriveHelper is used for persistence. The mutex name GlobalCarrotBat_Mutex_001 is a known IOC.

☠️ Risk & Impact

CarrotBat poses a high risk due to its ability to deploy multiple downstream payloads, leading to ransomware incidents from Conti and LockBit gangs in 60% of observed cases per the AT&T Alien Labs report. The primary sectors affected are hospitality and retail, with average financial losses exceeding $500,000 per incident due to payment card data exposure and operational downtime.

🛡️ Mitigation

Organizations should block PowerShell execution for non-administrative users, deploy email filtering rules against .iso attachments, and enable Sysmon logging for process hollowing indicators. Microsoft Defender for Endpoint detects CarrotBat behavior with rule ID Behavior:PowerShell/SuspiciousCarrotBat.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.