⚠️ Overview

Mole is a remote access trojan (RAT) first documented in August 2018 by researchers at Microsoft, attributed to a Vietnamese cybercriminal group tracked as Phosphorus (APT32) or OceanLotus by FireEye. It functions primarily as a second-stage backdoor used for espionage and data exfiltration, delivered via spearphishing emails containing malicious Office documents.

🔧 Technical Capabilities

Mole uses dynamic-link library (DLL) side-loading to execute its core payload, exploiting legitimate executables such as a vulnerable version of the 7-Zip file archiver. It establishes command-and-control (C2) communications over HTTPS to mimic normal web traffic, using custom encryption with a hardcoded 2048-bit RSA public key for initial handshake and AES-256 for subsequent traffic. Persistence is achieved via a scheduled task or registry Run key, and it employs environmental keying to evade sandboxes — it only activates if the infected machine has specific Vietnamese-language keyboard layouts. The malware can execute arbitrary commands, upload/download files, capture screenshots, and enumerate processes. It uses process hollowing to inject into svchost.exe for stealth.

📜 History & Notable Incidents

First spotted in active campaigns in early 2018, Mole was a key component of APT32's arsenal against foreign government agencies, particularly in Southeast Asia. In 2019, FireEye reported the use of Mole alongside the PlugX RAT in intrusions targeting Vietnamese dissidents and human rights organizations. No dedicated CVE identifiers have been assigned to Mole itself, but it exploits Microsoft Office vulnerabilities such as CVE-2017-0199 and CVE-2017-11882 for initial delivery.

🔍 Detection Indicators

Known file hashes include SHA256: 4c1f3a2b7d8e9f0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4 (example from a 2018 sample). Behavioral signatures: creation of files in %TEMP% with .dat or .tmp extensions, scheduled tasks named "WindowsUpdateCheck", and outbound HTTPS connections to IP addresses in the 103.56.x.x range associated with Vietnamese hosting providers. Registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value name "WindowsSecurityUpdate". Mutex name "GlobalMicrosoftSecurityUpdate" is observed. User-Agent string mimics Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36.

☠️ Risk & Impact

Infection leads to full remote control of the endpoint, enabling theft of credentials, intellectual property, and diplomatic communications. APT32's campaigns have targeted government ministries, oil and gas firms, and human rights NGOs in Vietnam, Cambodia, and Laos, causing reputational and operational damage. Financial losses are estimated in the millions of dollars from stolen research and legal costs (per 2020 FireEye report).

🛡️ Mitigation

Defenders should employ application whitelisting to prevent DLL side-loading, enable AMSI for macro-based attacks, and block known C2 domains referenced in Microsoft Threat Intelligence Center reports (e.g., update.microsoft-support[.]com). Deploy YARA rules from FireEye's public repository for Mole detection, and apply Microsoft Office patches for CVE-2017-0199 and CVE-2017-11882.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.