Reckless Rabbit

Executive Summary

Reckless Rabbit is a highly adaptive threat actor that blends sophisticated social engineering with advanced network obfuscation to conduct investment‐scam campaigns worldwide. By leveraging Facebook advertising, fake news content, and DNS cloaking, the group deceives users into submitting personal information or installing malicious PDF tools while targeting public and private sectors across the globe. Their operations combine phishing, credential dumping, and exploitation of software vulnerabilities, reflecting a multi‑stage attack model that challenges both user awareness and network defenses.

Goals & Targeting

Reckless Rabbit aims to acquire sensitive personal and corporate information with a clear emphasis on espionage across government, defense, and critical infrastructure domains. Their investment‑scam façade amplifies credibility, enabling large‑scale social engineering while concealing the underlying technical intrusion. By exploiting public vulnerabilities such as TeamCity CVE‑2023‑42793 and embedding custom credential‑dumping tools within a cloaked command‑and‑control framework, the actor seeks to maintain long‑term access, exfiltrate valuable data, and potentially disrupt operations of high‑profile targets.

Key Capabilities

• Social engineering via Facebook advertising
• DNS cloaking for domain obfuscation and C&C
• Pretexting through social media messaging to lure victims into installing malicious PDF viewers
• Exploitation of software vulnerabilities (e.g., TeamCity CVE‑2023‑42793)
• Spear-phishing campaigns across email and messaging platforms
• Watering hole attacks that redirect users to malicious landing pages
• Credential dumping using the Dukes toolkit (MiniDuke, CosmicDuke, OnionDuke, CozyDuke, SeaDuke, CloudDuke, HammerDuke)
• Deployment of custom back‑config malware for persistence and exfiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Reckless Rabbit conducts wide‑scale investment‑scam campaigns that adapt to regional regulatory and cultural norms by filtering traffic from specific countries and leveraging localized fake news anchors. Their modus operandi employs a multilayered attack chain: from the initial lure via Facebook ads and fake news to deployment of malicious PDF viewers, followed by exploitation of system vulnerabilities for deeper footholds, credential dumping, and eventual data exfiltration. The actor consistently shows an ability to rotate domains rapidly using RDGA techniques, implying significant operational tempo and resources. Victims span a broad spectrum—from defense contractors and critical‑infrastructure operators to financial services and media outlets—demonstrating the group’s broadening campaign reach over time.

IOC Patterns

• DNS cloaking (obfuscated domain resolution)
• Fake news article URLs routed via Facebook ads
• Malicious PDF viewer distribution via social media channels
• CVE identifiers in exploitation campaigns
• Spear-phishing email addresses and subject lines
• Watering hole landing page URLs

Recommended Actions

• Implement comprehensive user awareness training focused on social engineering, pretexting, and phishing via Facebook ads.
• Deploy DNS monitoring tools to detect anomalous or cloaked queries and automatically block known malicious domains.
• Enforce validation of PDF integrity through sandbox execution or hash comparison before allowing installation.
• Block or strictly filter Facebook ad links that redirect to unfamiliar or suspicious third‑party sites.
• Apply timely patches for critical vulnerabilities, particularly TeamCity CVE‑2023‑42793 and any legacy software referenced by the actor.
• Strengthen email filtering and apply advanced threat detection to mitigate spear‑phishing attempts.
• Monitor network traffic for watering hole indicators such as unusual access patterns or repeated connections to known malicious hosts.
• Block known malicious IPs, domain suffixes, or C2 infrastructures used by back‑config malware and Dukes toolkits.
• Implement intrusion detection/prevention signatures that flag credential dumping activity (e.g., use of lsass secrets or system utilities).

Suggested Tags