Ruthless Rabbit

Executive Summary

Ruthless Rabbit is a state‑aligned threat actor using sophisticated social engineering and domain cloaking techniques to run investment‑scam campaigns while also conducting targeted espionage against a wide range of governments, defense contractors and commercial sectors worldwide.

Goals & Targeting

Ruthless Rabbit’s strategic objectives blend espionage with financial exploitation. By targeting high‑profile sectors—government, defense, finance, media, energy, telecommunications among others—the actor seeks to gather actionable intelligence and possibly leverage the acquisition of credentials for secondary operations. The use of investment scams allows the entity to financially sustain its campaigns while simultaneously seeding malware into valuable organizational networks, effectively creating a dual revenue stream of extortion and data theft.

Key Capabilities

• DNS cloaking for domain obfuscation
• Social engineering through forged Facebook accounts and spear‑phishing links
• Malicious attachments and link delivery via Microsoft Word CVE exploitation
• Voice‑phishing (vishing) pretexts to gain initial access
• Deployment of remote access trojans such as RokRAT via email or RMM utilities
• Utilization of custom "Duke" malware families for data exfiltration and persistence
• Rapid “smash‑and‑grab” exfiltration followed by stealthy persistence
• Traffic monetization infrastructure post‑phishing compromise
• AI‑themed lure websites and counterfeit platforms (e.g., klingaimedia.com)
• Watering hole attacks on legitimate sites

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Ruthless Rabbit employs a consistent multi‑phase campaign pattern: initial infiltration via spear‑phishing or vishing, followed by installation of remote access trojans and RMM utilities; subsequent rapid data exfiltration (“smash‑and‑grab”) enables swift target compromise. When the asset proves valuable, tactics shift to stealthy persistence using custom malware families and domain cloaking. The actor has executed high‑profile scams such as the 2022 “Channel One” GazInvest investment fraud, targeting Russian, Polish, Romanian and Kazakh users. Broader intelligence links Rustless Rabbit to North Korean APT37 through shared RMM tactics and to APT29 (Dukes) via exfiltration patterns and domain infrastructure.

IOC Patterns

• Domain names used for DNS cloaking and spoofing
• Fake Facebook profiles posing as public figures
• Malicious URLs with redirects or intermediary sites
• Compromised legitimate websites used for watering holes
• Malicious Microsoft Word documents exploiting CVE‑2015‑1701
• Voice‑phishing call scripts
• Downloads of RMM utilities via screen‑sharing
• Indicators of remote access trojan activity (RokRAT)
• Exfiltration over command‑and‑control channel
• Signals associated with custom Duke malware families

Recommended Actions

• Deploy DNS monitoring and anomaly detection to identify malicious domain resolution patterns
• Block traffic to known spoofed domains such as klingaimedia.com and klingaistudio.com via sinkholes or web filtering
• Implement user awareness training focused on detecting fake social media accounts and pretexting attempts
• Apply application whitelisting or sandboxing to prevent installation of unsolicited PDF viewers or other malicious binaries
• Set up monitoring for remote access trojan activity (e.g., RokRAT) and RMM utilities
• Enhance email/FB filtering with advanced phishing detection to mitigate spear‑phishing links
• Educate employees on vishing and social engineering threats, including recognizing suspicious phone calls
• Implement strict verification procedures for remote access requests and screen‑sharing sessions
• Deploy endpoint detection and response to detect and isolate malicious Duke family malware
• Patch systems promptly for known vulnerabilities, notably CVE‑2015‑1701 and any other applicable CVEs
• Use web filtering to block compromised legitimate sites used in watering hole campaigns
• Employ network segmentation and IDS/IPS to detect rapid data exfiltration attempts
• Maintain up‑to‑date threat intelligence feeds on APT29/Dukes and similar actor toolsets
• Update endpoint protection with signatures for known malicious DLLs, Trojans, and RAT families

Suggested Tags