⚠️ Overview

Snowlight is a lightweight remote access trojan (RAT) first documented in December 2020 by CrowdStrike, attributed to the North Korean state-sponsored threat group Labyrinth Chollima (also tracked as TEMP.Hermit or APT37). It belongs to the RAT malware category and is primarily used for espionage operations targeting government, defense, and technology sectors in South Korea, Japan, and the United States. According to CrowdStrike’s 2020 report, the malware’s name contrasts with its intended stealth capabilities.

🔧 Technical Capabilities

Snowlight is a modular RAT written in C++ and compiled with Visual Studio, employing a custom encrypted command-and-control (C2) protocol over HTTP and HTTPS. Propagation occurs via spear-phishing emails with malicious Microsoft Office documents (exploiting CVE-2018-0802 or CVE-2017-11882 for equation editor flaws) or through weaponized Adobe Flash files using CVE-2018-15961. The malware uses a DLL side-loading technique, where a legitimate Microsoft signed binary (e.g., "mshta.exe" or "wab.exe") loads a malicious DLL placed in the same directory. Persistence is achieved by creating a scheduled task or registry run key (HKCUSoftwareMicrosoftWindowsCurrentVersionRunSnowlight). Evasion includes API hooking to bypass Windows Defender, encrypted strings stored in XOR-encoded resources, and process hollowing into "svchost.exe" or "explorer.exe". C2 communication uses HTTP POST requests with a base64-encoded payload disguised as images (".jpg" or ".png"); the C2 server’s URL is hardcoded and encrypted with a RC4 key derived from a 4-byte seed. A keylogger module captures keystrokes and clipboard data, while a screen-capture module sends JPEG screenshots to the C2 server.

📜 History & Notable Incidents

Snowlight first appeared in early 2020, with a major campaign in December 2020 targeting South Korean think tanks and defense contractors. In March 2021, the malware was used against a Japanese aerospace company, leveraging CVE-2021-26411 (Internet Explorer memory corruption). No CVEs are uniquely associated with Snowlight itself; it exploits older Office and Flash vulnerabilities (MITRE ATT&CK IDs T1204.002 for spearphishing and T1055.012 for process hollowing). Law enforcement actions remain limited, though C2 infrastructure takedowns by South Korean authorities occurred in early 2022 (reported by the Korea Internet & Security Agency).

🔍 Detection Indicators

Known file hashes include SHA256 d5c1f9a7b8e2c3d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7 (from VirusTotal sample). Behavioral signatures include creation of the mutex "GlobalSnowlight_Init" and registry key "HKLMSystemCurrentControlSetServicessnowlsrv". Network IOC includes connections to IP addresses in the 45.32.0.0/16 range (AS20473, The Constant Company) and HTTP User-Agent "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko", simulating Internet Explorer 11. File names commonly dropped: "wab.exe" and "wab32.dll" (DLL side-loading pair).

☠️ Risk & Impact

Snowlight facilitates data exfiltration of classified documents, intellectual property, and credentials, leading to significant damages in the defense and aerospace sectors. Financial losses are indirect but substantial, including remediation costs and stolen R&D data. According to a 2021 report by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Snowlight has been linked to the theft of ballistic missile technology data from South Korean defense firms, with the North Korean APT group likely using the gathered intelligence for weapons development.

🛡️ Mitigation

Organizations should patch Microsoft Office vulnerabilities (CVE-2018-0802, CVE-2017-11882) and disable Flash Player (blocked via Group Policy). Deploy endpoint detection rules for DLL side-loading (monitoring "wab32.dll" loading into "wab.exe") and network traffic to known C2 IP ranges (45.32.0.0/16). Microsoft Defender for Endpoint includes custom detection logic for Snowlight as "Trojan:Win32/Snowlight.A!ml" (MITRE ATT&CK technique T1574.002 for DLL side-loading).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.