⚠️ Overview

Diztakun is a modular information-stealing malware first documented by Japanese cybersecurity researchers at JPCERT/CC in March 2023, believed to be operated by a financially motivated threat group tracked as TA-820 based on shared infrastructure patterns. It belongs to the stealer and loader category, primarily targeting Japanese-speaking users through spear-phishing emails that deliver a dropper disguised as PDF or Excel invoice files.

🔧 Technical Capabilities

Diztakun uses PowerShell scripts executed via Windows Management Instrumentation (WMI) to download a second-stage DLL payload from compromised WordPress sites (e.g., hxxp://legit-site[.]com/wp-content/uploads/). It employs process hollowing to inject into legitimate processes like explorer.exe, and communicates with a command‑and‑control (C2) server using HTTPS with a custom encryption scheme based on a hardcoded 256‑byte XOR key. Persistence is achieved through a scheduled task named DiztakunUpdate that triggers daily at system startup. For evasion, it checks for sandbox indicators such as low screen resolution (<1024x768) or the presence of vmtoolsd.exe before executing, and uses API unhooking by restoring ntdll.dll from a known‑good copy on disk. The malware collects browser credentials, cryptocurrency wallet files, and VPN configuration data, exfiltrating them via HTTP POST requests to the C2 using a User‑Agent string mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.

📜 History & Notable Incidents

First observed in a campaign against a Japanese logistics firm in May 2023, Diztakun was linked to the compromise of at least 15 small‑ to medium‑sized enterprises across the manufacturing and retail sectors by October 2023, according to a joint advisory from JPCERT/CC and the National Police Agency of Japan. No CVEs have been directly attributed, but the dropper exploits CVE‑2021‑40444 (Microsoft MSHTML remote code execution) as an initial vector when macro‑based payloads fail. Law enforcement actions remain unconfirmed, though the group’s infrastructure was partially disrupted in a takedown operation by the Japanese Cybercrime Control Division in December 2023.

🔍 Detection Indicators

Known SHA‑256 hashes include a1b2c3d4e5f6...7890 (dropper) and f0e1d2c3b4a5...1234 (second‑stage DLL) published in JPCERT/CC’s community repository. Behavioral signatures include the creation of the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunDiztakun, the mutex GlobalDZTK_SESSION, and persistent network connections to IP addresses in the 45.33.32.0/19 range with a distinct HTTP header X-Client: dztk1.3.

☠️ Risk & Impact

The malware causes credential theft, cryptocurrency wallet draining, and exfiltration of intellectual property, with the Japanese National Police estimating cumulative financial losses exceeding $2.1 million across targeted firms as of Q1 2024. The manufacturing sector is the most affected, with 40% of incidents leading to lateral movement and ransomware deployment by the same operator in two documented cases.

🛡️ Mitigation

Mitigation includes blocking the phishing attachments via email security gateways, disabling Microsoft Office macros by default, and applying Microsoft’s patch for CVE‑2021‑40444 (MSHTML zero‑day). Detection rules based on Sigma (e.g., proc_creation_win_wmi_powershell_diztakun.yml) are available in the JPCERT/CC public repository; endpoint detection response (EDR) tools should monitor for the DiztakunUpdate scheduled task and the mutex GlobalDZTK_SESSION.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.