Thread by @ESETresearch

#ESETesearch discovered Dolphin, a sophisticated backdoor extending the arsenal of the #ScarCruft APT group. Dolphin has a wide range of spying capabilities and is deployed on selected targets only.
welivesecurity.com/2022/11/30/who… 1/6

The backdoor was used as the final payload of a multistage attack in early 2021, involving a watering-hole attack on a South Korean online newspaper, an Internet Explorer exploit, and another ScarCruft backdoor, named BLUELIGHT, previously reported by Volexity and Kaspersky. 2/6

While BLUELIGHT performs basic reconnaissance, Dolphin actively searches the drives of compromised systems for files of interest and exfiltrates them to Google Drive. Its other capabilities include keylogging, taking screenshots and stealing credentials from browsers. 3/6

Some Dolphin versions can lower the security of signed-in Gmail accounts, probably to maintain access to victims’ inboxes. To achieve this, the backdoor steals the existing cookie of the logged-in account from the browser and crafts requests modifying the settings. 4/6

Since the initial discovery of Dolphin in April 2021, we have observed multiple versions of the backdoor, as shown in the timeline, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection. 5/6

This research will be presented at the AVAR 2022 conference. aavar.org/cybersecurity-… 6/6