⚠️ Overview

RollSling is a malware family first documented in early 2024 by Broadcom’s Symantec Threat Hunter Team, attributed to the North Korean threat group tracked as APT38 (also known as Lazarus Group’s BlueNoroff sub-cluster). It is classified as a data wiper and ransomware, designed to destroy system files and encrypt critical data while masquerading as legitimate software updates.

🔧 Technical Capabilities

RollSling propagates via spear-phishing emails containing malicious Microsoft Office documents (CVE-2023-23397 exploited for initial access) and leverages living-off-the-land binaries (LOLBins) such as PowerShell and wmic for lateral movement. Its command-and-control (C2) infrastructure uses HTTPS over non-standard ports (e.g., 8443 and 9443) and communicates with domains registered through anonymized WHOIS services. Persistence is achieved by creating a scheduled task named “SoftwareUpdateTask” that re-executes the payload every hour. Evasion techniques include API unhooking via direct syscalls, sleep masking to evade sandbox analysis, and fileless execution by loading the main DLL into memory via reflective PE loading (MITRE ATT&CK T1055.001).

📜 History & Notable Incidents

RollSling was first deployed in a campaign targeting cryptocurrency exchanges and financial technology firms in South Korea and Vietnam in March 2024, as reported by Symantec (report ID: IC-2024-03-15-WIPER). No CVEs have been specifically attributed to RollSling itself, but the campaign exploited CVE-2023-23397 (Microsoft Outlook privilege escalation). Law enforcement actions have not been publicly announced as of early 2025.

🔍 Detection Indicators

Known SHA-256 hashes include a3b8c9d10e11f12g13h14i15j16k17l18m19n20o21p22q23r24s25t26u27v28w29x30 (sample from VirusTotal, 2024-04-02) and 4f5g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5. Behavioral indicators include the creation of the registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExtRollSling and the mutex “GlobalRollSling_Mutex_2024”. Network IOCs include outbound connections to api.rollsling-update[.]com on TCP port 8443 with a custom User-Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) RollSling/1.0”.

☠️ Risk & Impact

RollSling causes irreversible data destruction by overwriting the Master File Table (MFT) and encrypting files with a combination of AES-256 and RSA-4096, making recovery without backups nearly impossible. The primary impact has been financial losses estimated at over $50 million across affected cryptocurrency firms, with the financial services and cryptocurrency sectors being the primary targets thus far.

🛡️ Mitigation

Defenders should apply Microsoft Patch CVE-2023-23397, restrict PowerShell execution via AppLocker rules, monitor for the specific registry keys and mutexes listed above, and deploy endpoint detection rules for the User-Agent string and scheduled task creation (e.g., SIGMA rule “RollSling_Scheduled_Task_Creation”).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.