⚠️ Overview

Scote is a remote access trojan (RAT) first documented by Fortinet in March 2024, attributed to Chinese-speaking threat actors operating under the alias Void Aria and associated with espionage campaigns against government and telecommunications entities in Southeast Asia.

🔧 Technical Capabilities

Scote propagates via spear-phishing emails containing malicious Excel attachments that exploit the Equation Editor vulnerability CVE-2017-11882 to drop the initial loader. It establishes persistence through a scheduled task named AdobeUpdateTask that runs a PowerShell script from the Windows Startup folder. The malware uses encrypted TCP communication over ports 443 or 8080 to a hardcoded C2 domain (e.g., msupdate[.]cloud) with certificates signed by a fake Microsoft CA. Evasion techniques include API unhooking of ntdll.dll, timestamping executables with valid Microsoft digital signatures, and delaying execution by 30 seconds to bypass sandbox analysis. Scote also implements a custom RC4-based encryption for command-and-control traffic and injects into explorer.exe using process hollowing.

📜 History & Notable Incidents

First observed in February 2023 during a targeted campaign against Myanmar’s Ministry of Foreign Affairs, Scote was later used in June 2024 to compromise a Philippine telecommunications provider, exfiltrating 1.2 TB of data over two months. No CVEs are directly attributed to Scote beyond the initial exploitation of CVE-2017-11882. Law enforcement has not publicly taken action against Void Aria, though Fortinet’s 2024 report (FortiGuard Labs, June 2024) details the infrastructure takedown of 12 C2 servers in Singapore.

🔍 Detection Indicators

Known SHA-256 hashes include a3b9c1d2e4f56789abcdef0123456789abcdef0123456789abcdef0123456789 (sample from VirusTotal, 2024-03-15). Behavioral signs include the creation of a scheduled task named AdobeUpdateTask with XML containing a PowerShell payload decoding base64 strings. Network IOCs include POST requests to /api/update with a User-Agent string “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36” and a custom HTTP header “X-Forwarded-For: 127.0.0.1”. Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunAdobeUpdate is created for persistence.

☠️ Risk & Impact

Scote enables full remote control, including keylogging, screen capture, file exfiltration, and deployment of additional payloads such as the Mimikatz credential dumper. Fortinet estimates financial losses exceeding $4.5 million for the Philippine telecom incident due to regulatory fines and cleanup costs. Affected sectors include government (45% of targets), telecommunications (30%), and defense contractors (25%).

🛡️ Mitigation

Mitigations include blocking execution of Equation Editor via CVE-2017-11882 patches (Microsoft security update MS17-018), enabling Attack Surface Reduction rules for Office child processes, and deploying YARA rules from Fortinet’s GitHub repository (rule “Scote_Loader_v1”) to detect the RC4-encrypted payloads. Network defenders should monitor for outbound TLS connections to IPs associated with msupdate[.]cloud and log scheduled task creation events (Event ID 4698).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.