Hagga

Also known as: Aggah, Hagga, Operation “Red Deer”, Operation “Roma225”, TH-157

Hagga is believed to have been using Agent Tesla, 2021’s sixth most prevalent malware, to steal sensitive information from his victims since the latter part of 2021.

🌍 Country ["[Unknown]"]

Associated Operations

2018-12 2019-06 2019-09 2020-01 2020-04 2020-05 2021-07 2021-10 2022-06 Aggah Using Compromised Websites to Target Businesses Across Asia During our Cyber Threat Intelligence monitoring we spotted new malicious activities targeting some Italian companies operating worldwide in the manufacturing sector During our threat monitoring activities In the past months since the Covid-19 outbreak Including Taiwan Manufacturing Industry New Aggah Campaign Hijacks Clipboards to Replace Cryptocurrency Addresses Operation “Red Deer” Operation “Roma225” Recently The Cybaze-Yoroi ZLab researchers investigated a recent espionage malware implant weaponized to target companies in the Italian automotive sector. The malware was spread through well written phishing email trying to impersonate a senior partner of one of the major Brazilian business law firms: “Veirano Advogados”. The Evolution of Aggah: From Roma225 to the RG Campaign Upgraded Aggah malspam campaign delivers multiple RATs during our Cyber Defence monitoring operations https://blog.talosintelligence.com/2020/04/upgraded-aggah-malspam-campaign.html https://perception-point.io/blog/operation-red-deer/ https://www.anomali.com/blog/aggah-using-compromised-websites-to-target-businesses-across-asia-including-taiwan-manufacturing-industry https://www.deepinstinct.com/2020/05/25/aghast-at-aggah-teasing-security-controls-with-advanced-evasion-techniques/ https://www.riskiq.com/blog/external-threat-management/aggah-clipboard-hijack-crypto/ https://yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/ https://yoroi.company/research/apt-or-not-apt-whats-behind-the-aggah-campaign/ https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ https://yoroi.company/research/the-enigmatic-roma225-campaign/ https://yoroi.company/research/the-evolution-of-aggah-from-roma225-to-the-rg-campaign/ some of them also part of the automotive production chain. we discovered an interesting drop chain related to the well-known Aggah campaign we have seen an enormous rise in mal-spam campaigns where hackers abuse the pandemic to try and claim victims. One such campaign that we spotted is a new variant of a unique malware loader named ‘Aggah’. we spotted other attack attempts directed to some Italian companies operating in the Retail sector.

Introduction

Hagga is believed to have been using Agent Tesla, 2021’s sixth most prevalent malware, to steal sensitive information from his victims since the latter part of 2021.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2018-12
  • 2019-06
  • 2019-09
  • 2020-01
  • 2020-04
  • 2020-05
  • 2021-07
  • 2021-10
  • 2022-06
  • Aggah Using Compromised Websites to Target Businesses Across Asia
  • During our Cyber Threat Intelligence monitoring we spotted new malicious activities targeting some Italian companies operating worldwide in the manufacturing sector
  • During our threat monitoring activities
  • In the past months since the Covid-19 outbreak
  • Including Taiwan Manufacturing Industry
  • New Aggah Campaign Hijacks Clipboards to Replace Cryptocurrency Addresses
  • Operation “Red Deer”
  • Operation “Roma225”
  • Recently
  • The Cybaze-Yoroi ZLab researchers investigated a recent espionage malware implant weaponized to target companies in the Italian automotive sector. The malware was spread through well written phishing email trying to impersonate a senior partner of one of the major Brazilian business law firms: “Veirano Advogados”.
  • The Evolution of Aggah: From Roma225 to the RG Campaign
  • Upgraded Aggah malspam campaign delivers multiple RATs
  • during our Cyber Defence monitoring operations
  • https://blog.talosintelligence.com/2020/04/upgraded-aggah-malspam-campaign.html
  • https://perception-point.io/blog/operation-red-deer/
  • https://www.anomali.com/blog/aggah-using-compromised-websites-to-target-businesses-across-asia-including-taiwan-manufacturing-industry
  • https://www.deepinstinct.com/2020/05/25/aghast-at-aggah-teasing-security-controls-with-advanced-evasion-techniques/
  • https://www.riskiq.com/blog/external-threat-management/aggah-clipboard-hijack-crypto/
  • https://yoroi.company/research/aggah-how-to-run-a-botnet-without-renting-a-server-for-more-than-a-year/
  • https://yoroi.company/research/apt-or-not-apt-whats-behind-the-aggah-campaign/
  • https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/
  • https://yoroi.company/research/the-enigmatic-roma225-campaign/
  • https://yoroi.company/research/the-evolution-of-aggah-from-roma225-to-the-rg-campaign/
  • some of them also part of the automotive production chain.
  • we discovered an interesting drop chain related to the well-known Aggah campaign
  • we have seen an enormous rise in mal-spam campaigns where hackers abuse the pandemic to try and claim victims. One such campaign that we spotted is a new variant of a unique malware loader named ‘Aggah’.
  • we spotted other attack attempts directed to some Italian companies operating in the Retail sector.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Agent.btz
  • Agent Tesla:
  • Aggah:
  • NanoCore RAT:
  • RevengeRAT:
  • Warzone RAT:
  • njRAT:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.