A threat actor, Agent Racoon, attacked organizations in the Middle East, Africa, and the United States. As per the analysis of Chema Gracia, on December 2nd, 2023, Racoon utilized the .Net framework to create the virus. He also attached DNS known as domain name service protocol to this malware. The main purpose of this backdoor was to generate a covert channel and offer backdoor functionalities.

One of the most important things about this attack that is a must for all to be familiar with is that it laid its inverse impact on a range of sectors. These sectors include- real estate, telecommunication, education, retail, non-profits, and civil. An interesting part of this activity was that it aimed to follow a criminology pattern and also consisted of techniques to find ways to provide security to assess threats.

Well, so many cybersecurity organizations are making use of the moniker CL-STA-0002  to track the threats. One of the surprising things is that rivals preferred to use tools of tailor-made versions known as Mimilite. Not only this but also they used Ntospy. Ntospy gave preference to utilize a tailor-made DLL module for the implementation of a network provider and for holding up login details remotely.

As per the opinion of Gracia, the Mimilite tools and the Agent Racoon malware were found merely in the atmospheres of the organizations of officials & philanthropics.

It has come to the notice that both the  CL-STA-0043 and Ntospy have an interrelation between them. A number of scheduled tasks have an impact on the malware. It implements commands, uploads & downloads files. In addition to this, agent Racoon differentiates itself from Google Update and Microsoft OneDrive Updater binaries

One of the crucial facts is that this malware is followed by an infrastructure namely- C2 ( command-and-control). As per its examination, its premature sample was synced in the year 2022, in July month. According to Unit 42, the latest cybersecurity research, this virus disclosed Microsoft Exchange Server’s data including- emails. It also impacted the Roaming profile of victims.