Researchers have observed RedEyes (also known as APT37 and ScarCruft) using a previously unknown information-stealing malware dubbed “FadeStealer” as well as the “AblyGo Backdoor”. RedEyes is a state-sponsored advanced persistent threat (APT) group that has historically conducted cyberattacks aligned with North Korean interests, including against North Korean defectors, human rights activists, and university professors. Researchers explained that the malware is assumed to be delivered through spear-phishing emails with a typical password-protected document and a fraudulent password file attached. A Compiled HTML Help File (CHM) malware is masqueraded as the password file so the campaign victims believe they must execute the disguised malware in order to view the password-protected document. Once executed, the victim can view the password information and an internal script is executed in the background, which causes a script (called MSTHA PowerShell) from RedEyes’ command-and-control (C2) server to be executed. The initial malware, which contains a backdoor feature, establishes persistence through an autorun registry key and the operators were observed carrying out privilege escalation, exfiltration, and malware distribution at a later time. The malware distribution is conducted through AblyGo Backdoor. Ably Backdoor exploits the Ably service, which is a real-time data transfer and messaging platform that contains publish/subscribe messaging, push notification, real-time query, and state synchronization capabilities. This malware, in combination with the malicious script initially run by the C2 server, then executes the FadeStealer info-stealer. FadeStealer has been noted to contain “wiretapping features” as well as the capabilities to take screenshots, exfiltrate data from removable media devices and smartphones, and conduct keylogging. Users are urged to remain vigilant of emails sent from unknown senders and to refrain from executing attachments prior to verifying the source of the email. Additional technical details of RedEyes’ latest campaign as well as indicators of compromise (IOCs) can be viewed in the report linked below.