Maduro Arrest Used as a Lure to Deliver Backdoor

Darktrace researchers observed threat actors exploiting reports of Venezuelan President Nicolás Maduro’s arrest to deliver backdoor malware.

The campaign is described as using a spear-phishing email containing a zip archive titled “_US now deciding what’s next for Venezuela.zip_,” which includes an executable named “Maduro to be taken to New York.exe” and a DLL “kugou.dll.” The payload installs a persistence mechanism by creating a ProgramData directory, dropping DataTechnology.exe, and adding a Run registry key to launch on logon.

C2 beaconing commences over TLS to 172.81.60[.]97 on port 443, with regular traffic implying external instructions or configuration. The blog notes that similar lures have been used by the Chinese threat group Mustang Panda, though there is insufficient information to confidently attribute this activity to a specific group, and it frames the technique as consistent with prior campaigns. Overall, it highlights how current-events lures continue to raise the likelihood of successful compromises.