larva-24009

Executive Summary

Larva‑24009, also called Thoreau’s flower moth and HeptaX, runs a multi-year financial‑gain campaign that uses spear‑phishing with malicious LNK attachments to deliver obfuscated PowerShell backdoors. The actor establishes persistence via scheduled tasks and privileged accounts, then deploys QuasarRAT or UltraVNC for remote control while harvesting credentials through NirSoft utilities. Its operations span healthcare, maritime, finance, defense and hospitality organizations across South Korea, Australia, Russia and Brazil.

Goals & Targeting

Larva‑24009 seeks to monetize compromised systems by stealing credentials, capturing sensitive data through keylogging and screen capturing, and leveraging stolen accounts for persistent remote access. Its sector‑agnostic approach targets industries that routinely handle large volumes of confidential or financial information, with a noted emphasis on South Korean organizations but also extending globally to countries such as Australia, Russia and Brazil.

Key Capabilities

• Spear-phishing with malicious LNK attachments
• Execution via obfuscated PowerShell scripts
• Persistence through scheduled‑task creation
• C&C reporting via Telegram API
• Installation of remote access trojans QuasarRAT and UltraVNC
• Creation of privileged backdoor accounts (e.g., _BootUEFI_)
• Exploitation of RDP for lateral movement
• Data exfiltration with NirSoft tools
• Screen capturing and keylogging for credential theft

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Since its first appearance in 2023, Larva‑24009 has maintained a high operational tempo characterized by large-scale spear‑phishing campaigns that combine social engineering with advanced malware delivery chains. The group prefers legitimate cloud hosting for drop points, which makes detection more difficult, and it routinely updates toolsets—shifting from older RATs like njRAT to newer ones such as QuasarRAT—to evade defenses. Victims are drawn from diverse industries and geographies, often accessed through public-facing email infrastructures, while the actor leverages living‑off‑the‑land techniques (MSBuild.exe, Equation Editor exploit) for persistence and privilege escalation.

IOC Patterns

• Phishing email attachment with malicious LNK file
• Obfuscated PowerShell script execution
• Scheduled-task persistence creation
• Telegram API-based command and control communications
• Privileged account creation with suspicious names
• RDP exploitation for lateral movement
• NirSoft credential harvesting tools in use
• Screen capture and keylogging activity

Recommended Actions

• Block and filter phishing emails that contain malicious LNK attachments.
• Educate users through spear‑phishing awareness training to recognize unexpected attachment-based threats.
• Implement monitoring for creation of new scheduled tasks or execution of known obfuscated PowerShell scripts.
• Detect and alert on the creation of privileged accounts with anomalous names such as "_BootUEFI_".
• Restrict and secure RDP access, enforce MFA for remote connections.
• Deploy endpoint detection that identifies QuasarRAT, UltraVNC, njRAT and other RAT families.
• Block or monitor outbound traffic to Telegram API endpoints used for command and control.
• Apply least‑privilege principles to limit credential theft via keylogging and screenshot tools.
• Maintain network segmentation and monitor for suspicious data exfiltration patterns over HTTP/HTTPS or SMB.
• Use domain and IP reputation services to block known malicious hosting domains.

Suggested Tags