CostaRicto__2020__The_CostaRicto_Campaign_Cyber-Espionage_Outsourced.pdf

The BlackBerry Research and Intelligence report dissects the CostaRicto campaign — an outsourced, mercenary-style cyber‑espionage operation that uses a custom backdoor (SombRAT) and VM-based loader (CostaBricks) delivered via scheduled tasks, PowerShell loaders, and reverse-DNS stagers; it employs DNS tunneling, RSA/AES encryption, SSH tunnelling and proxy layers for C2, targets diverse global victims (notably in South Asia), and includes IoCs (hashes, domains, IPs), YARA hunting rules, IDA Python scripts and MITRE mappings to aid detection and response.