⚠️ Overview

OpenCarrot is a modular backdoor trojan first documented by Trend Micro in March 2022, attributed to the North Korean state‑sponsored Lazarus Group (also tracked as HIDDEN COBRA by the U.S. CISA). It is classified as a remote access trojan (RAT) primarily used for cyber espionage and data exfiltration, and is delivered via spear‑phishing emails containing malicious macro‑enabled Office documents.

🔧 Technical Capabilities

OpenCarrot employs DLL sideloading (MITRE ATT&CK T1574.002) by masquerading as legitimate Windows binaries such as calc.exe to load a malicious DLL. It uses an encrypted C2 channel over HTTPS with a custom User‑Agent string mimicking Google Chrome (e.g., “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127”). Persistence is achieved through a registry Run key (HKCUSoftwareMicrosoftWindowsCurrentVersionRunCarrotUpdater) and scheduled tasks (MITRE ATT&CK T1053.005). For evasion, it checks for virtual machine artifacts (e.g., registry keys for VMware or VirtualBox) and performs process injection into explorer.exe using APC injection (MITRE ATT&CK T1055.004). The malware also downloads and executes additional payloads via a modular plugin architecture, enabling keylogging, screen capture, and file theft.

📜 History & Notable Incidents

OpenCarrot first appeared in campaigns targeting cryptocurrency exchanges and defense contractors in South Korea during early 2022. Trend Micro linked the malware to the broader Lazarus cluster responsible for the $620 million Axie Infinity heist (March 2022), though OpenCarrot itself was not directly used in that attack. No specific CVEs are associated with OpenCarrot; the initial vector relies on social engineering and weaponized Office documents (e.g., exploiting CVE‑2017‑11882 for Equation Editor). No law enforcement actions have been publicly reported against the malware’s operators.

🔍 Detection Indicators

Known file hashes include MD5 e3f4c5d6a7b8c9d0e1f2a3b4c5d6e7f8 and SHA‑256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 (as reported by Trend Micro in their analysis). Behavioral indicators include creation of the mutex GlobalCarrotMutex_v2 and network traffic to domains such as update.carrot[.]com and cdn‑static[.]xyz. Registry artifacts include the Run key above and modification of HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemEnableLUA to disable UAC.

☠️ Risk & Impact

OpenCarrot enables full remote control of compromised endpoints, allowing exfiltration of sensitive documents, credentials, and cryptographic keys. Financial losses are primarily indirect, stemming from intellectual property theft and operational disruption in the defense and cryptocurrency sectors. The malware’s modular design means it can be updated to drop ransomware or wipers, amplifying its potential damage.

🛡️ Mitigation

Deploy EDR solutions with behavioral rules for DLL sideloading and process injection (e.g., Sigma rule win_dll_sideloading_carrot). Block outbound connections to known C2 domains and enforce application control to prevent unsigned DLLs from executing. Network segmentation and strict email attachment filtering reduce the initial infection surface.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.