The ScarCruft hacker group has initiated a new malware campaign that utilizes Rust programming language and the PubNub service.

The North Korean state-sponsored Advanced Persistent Threat (APT) group ScarCruft has initiated a sophisticated malware campaign aimed at South Korean users, utilising a deceptive postal-code update notice as bait. This attack signifies a notable advancement in ScarCruft’s operational capabilities, as it marks the first recorded deployment of ransomware alongside their traditional espionage tools. The campaign highlights ScarCruft’s embrace of modern programming languages and innovative command-and-control infrastructure to improve evasion of detection. The attack chain commences with a malicious LNK file embedded within a RAR archive, masquerading as a legitimate postal service notification. Upon execution, the LNK file activates an AutoIt loader that retrieves and executes multiple payloads from external servers, establishing a multi-stage infection process designed to circumvent conventional security measures. This operation has been linked to ChinopuNK, a specialised subgroup within ScarCruft that concentrates on distributing various malware strains via real-time messaging platforms.

S2W researchers have identified nine distinct malware samples within this campaign, several of which represent significant technological advancements for the group. Noteworthy additions include NubSpy, a backdoor that utilises PubNub for command-and-control communications, and CHILLYCHINO, a Rust-based backdoor adapted from earlier PowerShell versions. The campaign also introduced VCD Ransomware, which encrypts victim files with a .VCD extension, marking ScarCruft’s inaugural venture into ransomware deployment. The strategic adoption of the Rust programming language for backdoor development indicates a shift towards enhanced detection evasion capabilities. CHILLYCHINO exemplifies ScarCruft’s commitment to modernising their toolkit by transitioning existing PowerShell functionality into a compiled language that offers superior performance and reduced antivirus detection rates. By leveraging PubNub’s legitimate real-time messaging service as its command-and-control channel, the malware blends malicious traffic with normal network communications. This campaign’s technical sophistication, coupled with the introduction of ransomware capabilities, suggests that ScarCruft may be expanding its focus beyond traditional espionage operations towards financially motivated activities, signalling a concerning evolution in North Korean cyber warfare tactics.