Packed With Features, 'SambaSpy' RAT Delivers Hefty Punch

"SambaSpy," a recently surfaced remote access Trojan (RAT), is loaded up with a Swiss Army knife-like set of functions for spying on victims and stealing data from them. Its creators, thought to be Brazilian, have also made the versatile RAT hard to detect and analyze by obfuscating it with Zelix KlassMaster, a legitimate Java obfuscation tool that developers often use to protect their code against reverse engineering and unauthorized modification.

The Perfect Tool?

Researchers at Kaspersky first spotted SambaSpy in May. "The malicious campaign we uncovered was exclusively targeting victims in Italy," Kaspersky said in a report this week. "It's likely that the attackers are testing the waters with Italian users before expanding their operation to other countries." More recent evidence suggests the attackers may be expanding to targets in Spain, Brazil, and potentially other countries, Kaspersky said.

SambaSpy is a RAT that an attacker can use to download and upload files, manage the file system and processes, load additional plug-ins, and take complete remote control of a compromised system. Among other functions, the RAT can also take screenshots, steal passwords, control webcams, and log keystrokes. It's a combination of capabilities that Kaspersky assessed would make the malware "the perfect tool for a 21st century James Bond villain."

Threat actors use remote access Trojans like SambaSpy for a variety of reasons. Some common use cases include targeted information stealing, dropping other malware, credential stealing, and cyber espionage.

Testing the Waters

SambaSpy's feature set appears to make the malware suitable for any of these purposes. Like most other RATs — and indeed any malware for that matter — the alleged Brazilian threat group behind it is distributing the malware via phishing emails spoofed to appear like they are from a real estate company.

Users who click on the call-to-action in the email are redirected to a website that checks the victim's operating system language and the browser. If the OS is in Italian and if the browser is Edge, Chrome, or Firefox, the malicious site injects a malicious PDF file containing either a dropper or a downloader that each do the same thing: install SambaSpy on the victim system. As is common with most modern malware, the SambaSpy dropper/downloader first checks if it has landed on a virtual system, before installing the malware. Interestingly, if the OS language is not Italian, the malicious website redirects the potential victim to a legitimate website for online invoices.

Though the tactic of using email to deliver SambaSpy might seem low-tech, it remains the most effective vector for initial access. A Trend Micro study conducted earlier this year showed email to be among the top initial access vectors; Trend Micro claims that 73.8 billion of the more than 161 billion threats that it blocked in 2023 used email as the initial access vector. The company expects such attacks are going to continue with generative AI tools that let attackers craft phishing lures that will also get progressively harder to spot.

"For the attackers, it doesn't really matter who they hit, nor are the particulars of the phishing bait important," Kaspersky said. "Today, it might be an invoice from a real estate agency; tomorrow, a tax notification; and the day after that, airline tickets or travel vouchers."