VERY IMPORTANT

Cylance researchers uncovered a novel payload loader that utilizes steganography to read an encrypted payload concealed within a .png image file. The steganography algorithm appears to be bespoke and utilizes a least significant bit approach to minimize visual differences when compared with the original image to prevent analysis by discovery tools. Once decoded, decrypted, and executed, an obfuscated loader will load one of the APT32 backdoors. Thus far, BlackBerry Cylance has observed two backdoors being used in combination with the steganography loader – a version of Denes backdoor (bearing similarities to the one described by ESET), and an updated version of Remy backdoor. However, this can be easily modified by the threat actor to deliver other malicious payloads. The complexity of the shellcode and loaders shows the group continues to invest heavily in development of bespoke tooling.