A cyber espionage campaign has come to light, targeting government entities in Guyana with a previously unknown backdoor designed to harvest sensitive information. Researchers from cybersecurity firm ESET have named this new threat “DinodasRAT,” drawing inspiration from the hobbit Dinodas in the Lord of the Rings. The attackers also employed the Korplug backdoor, a tool typically associated with China-aligned groups like Mustang Panda.
Furthermore, ESET’s investigation revealed that the malicious activity within Guyana’s networks took place in February 2023, a period marked by strained diplomatic relations between Guyana and China. During this same timeframe, Guyana authorities arrested three individuals in a money laundering investigation involving Chinese companies, leading to objections from the Chinese embassy.
Additionally, the attack was carefully orchestrated, with the threat actors crafting malicious emails specifically designed to entice victim organizations. These emails predominantly revolved around topics related to Guyana’s politics. Clicking on a link in these emails led to the download of a ZIP file from a compromised Vietnamese government website, containing malware samples. When opened, this ZIP file infected the victim’s system with the DinodasRAT malware.
At the same time, DinodasRAT is a remote access trojan coded in the C++ programming language, granting attackers the ability to exfiltrate files, manipulate Windows registry keys, and execute commands on the compromised system. ESET did not disclose the campaign’s level of success or the extent of data stolen by the hackers, but this discovery underscores the ongoing threats posed by cyber espionage campaigns with sophisticated backdoors.
