Black Lotus Labs recently discovered the highly targeted, sophisticated campaign which has been active in North America and Europe for nearly two years beginning in October 2020.

The campaign included ZuoRAT – a multi-stage RAT developed for SOHO routers leveraging known vulnerabilities – which allowed the threat actor to enumerate the adjacent home network, collect data in transit, and hijack home users' DNS/HTTP internet traffic. The actor was able to remain undetected by living on devices rarely monitored, and by hijacking DNS and HTTP traffic.

The hijacking capability allowed the threat actor to pivot from the router to workstations in the network where they likely deployed two additional custom-built RATs – one of which allowed for cross-platform functionality (i.e. Windows, Linux and MacOs). These additional RATs allowed the actor to upload/download files, run commands and persist on the workstation.

Black Lotus Labs also identified two distinct sets of command-and-control (C2) infrastructure.

The first was developed for the custom workstation RAT and relied upon third-party services from Chinese companies. The second set of C2s was developed for the routers.

Using proprietary telemetry from the Lumen global IP backbone, Black Lotus Labs identified that, once infected, the routers communicated with other compromised routers to further obfuscate malicious activity.