Novel “Kraken” Attacks Abuse the Windows Error Reporting Service

  • An unidentified APT group is using spear phishing to launch file-less attacks on Windows systems.
  • The method involves abusing the Windows Error Reporting service, leading to shellcode injection on target processes.
  • The researchers who discovered the campaign have reasons to believe this is the work of Vietnamese hackers.

There’s a new type of attack called “Kraken,” which involves injecting a payload into the Windows Error Reporting (WER) service. This service handles errors in the operating system and the applications that run on it, so fiddling with it means that the hackers can exploit a deeper level of Windows API functions.

Malwarebytes, who has been following this campaign, believes that the attacks are launched by an APT group, potentially the Vietnamese APT32, but there can be no confident attribution. The actors launch their attacks using spear-phishing techniques and a document titled “Compensation manual.doc,” and with so many people having lost or on the verge of losing their jobs right now, this theme is very alluring.

For pretense reasons of confidentiality, the document is supposedly encrypted, and the recipient is advised to “enable content” in order to view it. This is a trick to make the victim enable macros on their Office suite, which then downloads a custom version of the CactusTorch VBA module, eventually resulting in the execution of shellcode.

Source: Malwarebytes

Next, a .Net payload is loaded into the memory and an entry class defined with a “Kraken.Kraken” value is created. Upon the execution of the payload, the injection to the WER is carried out, setting things up for pushing shellcode into target processes via Windows API calls.

Read More: Newly Unearthed APT Group “XDSpy” Has Been Around Since 2011

After de-obfuscating the injected shellcode, Malwarebytes researchers figured that the payload is capable of detecting if it runs inside a sandbox environment and stops to avoid analysis. Anti-debugging features are also present and actually quite extensive.

Source: Malwarebytes

The API calls that are supported by the shellcode are the following:

  • VirtualAlloc
  • VirtualProtect
  • CreateThread
  • VirtualAllocEx
  • VirtualProtectEx
  • WriteProcessMemory
  • GetEnvironmentVariableW
  • CreateProcessW
  • CreateRemoteThread
  • GetThreadContext
  • SetThreadContext
  • ResumeThread

The fetching of the additional shellcode that is injected into the target processes is done via an HTTP request, pointing to compromised websites such as the “”

Source: Malwarebytes

MalwareBytes mentions several similarities to previously recorded APT32 activity, like the use of CactusTorch, but since they couldn’t get the final payload, they are not in a position to attribute this campaign to anyone with certainty. The malicious archives are hosted in a domain registered in Ho Chi Minh, Vietnam, which is consistent with the APT32 assumption, but this is still no solid proof.


Recent Articles

How to Watch Taylor Swift’s Folklore: The Long Pond Studio Session

Taylor Swift's Folklore album broke all sorts of records this year, and we're now getting an intimate concert of it all! In...

Everything That’s Coming to Amazon Prime in December 2020

Amazon Plus is preparing a bunch of cool movies and shows for the length of December. We're quite eager to see what...

12 Best VPN Black Friday & Cyber Monday Deals 2020 (LIVE NOW)

As you've surely noticed, Black Friday and Cyber Monday are no longer one-day shopping events. Instead, you'll see many deals spanning across...