Google TAG: Kremlin cyber spies move into malware with a custom backdoor
(2024/01/18)
- Reference: 1705586411
- News link: https://www.theregister.co.uk/2024/01/18/google_tag_coldriver_malware/
- Source link:
Russian cyberspies linked to the Kremlin's Federal Security Service (FSB) are moving beyond their usual credential phishing antics and have developed a custom backdoor that they started delivering via email as far back as November 2022, according to Google's Threat Analysis Group.
TAG tracks this crew as COLDRIVER, while other threat hunters call the government-backed gang Star Blizzard, UNC4057 and Callisto. The gang has been active since at least 2019, and historically targets academia, the military, governmental orgs, NGOs, think tanks, and politicians in US, the UK and other NATO countries.
Since [1]Russia invaded its neighbor in February 2022, COLDRIVER has also stepped up its snooping activities against Ukraine's military and defense targets as well as those of other Eastern European nations.
[2]
It turns out they're moving into malware with a backdoor called SPICA. It's written in Rust and uses JSON over websockets for command and control (C2), we're told.
[3]
[4]
Once executed on a victim's device, it has several capabilities including executing shell commands, stealing cookies from Chrome, Firefox, Opera and Edge; uploading and downloading files; and snooping through and stealing documents.
"TAG has observed SPICA being used as early as September 2023, but believe that COLDRIVER's use of the backdoor goes back to at least November 2022," the Chocolate Factory's threat hunting team said in an [5]analysis published today.
[6]
SPICA is the first custom malware that TAG attributes to the Kremlin-backed group.
In addition to publishing details about the backdoor and how the campaign works, the Chocolate Factory also posted an extensive list of indicators of compromise including hashes, the SPICA sample name, and C2 address.
These expeditions tend to be highly targeted, focusing on "high-profile individuals in NGOs, former intelligence and military officials, defense, and NATO governments," Google TAG's Billy Leonard told The Register .
[7]
"TAG has only observed SPICA used in a very small number of campaigns, targeting a small number of organizations and individuals," Leonard said.
To deliver the malware, COLRIVER relies on its older, tried-and-true tactics.
[8]Five Eyes nations warn Moscow's mates at the Star Blizzard gang have new phishing targets
[9]Sandworm's Kyivstar attack should serve as a reminder of the Kremlin crew's 'global reach'
[10]Ivanti zero-day exploits explode as bevy of attackers get in on the act
[11]Secret multimillion-dollar cryptojacker snared by Ukrainian police
The criminals research their targets on social media, creating fake profiles and messaging their marks to build rapport.
They also use web-based email accounts that impersonate someone the target knows or a well-known industry figure, and go after high-profile individuals' personal email accounts, which are usually less protected than the same individuals' official government inboxes.
Just last month the Five Eyes' government agencies and Microsoft issued [12]separate reports about COLDRIVER's increasingly sophisticated evasion techniques and phishing tactics.
"As far back as November 2022, TAG has observed COLDRIVER sending targets benign PDF documents from impersonation accounts," the Chocolate Factory said in today's account of the gang's evolving espionage efforts.
The crew impersonates email addresses to trick victims into believing these documents are op-eds, or some other article for publication. The victim, we're told, can't open the benign PDF, which appears to be encrypted.
It's not, but this usually prompts a return email from the victim saying they can't open the doc. Then the phony email account responds with a link to a "decryption" utility that is actually the SPICA backdoor.
While the threat hunters were only able to snag one instance of the malware to analyze, they believe there are multiple versions of SPICA, each using a different decoy PDF. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2022/02/23/us_sanctions_russia/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/12/08/five_eyes_star_blizzard_warning/
[9] https://www.theregister.com/2024/01/05/sandworm_kyivstar_hack/
[10] https://www.theregister.com/2024/01/16/ivanti_zeroday_exploits_explode_into/
[11] https://www.theregister.com/2024/01/12/secret_multimilliondollar_cryptojacker_snared_by/
[12] https://www.theregister.com/2023/12/08/five_eyes_star_blizzard_warning/
[13] https://whitepapers.theregister.com/
TAG tracks this crew as COLDRIVER, while other threat hunters call the government-backed gang Star Blizzard, UNC4057 and Callisto. The gang has been active since at least 2019, and historically targets academia, the military, governmental orgs, NGOs, think tanks, and politicians in US, the UK and other NATO countries.
Since [1]Russia invaded its neighbor in February 2022, COLDRIVER has also stepped up its snooping activities against Ukraine's military and defense targets as well as those of other Eastern European nations.
[2]
It turns out they're moving into malware with a backdoor called SPICA. It's written in Rust and uses JSON over websockets for command and control (C2), we're told.
[3]
[4]
Once executed on a victim's device, it has several capabilities including executing shell commands, stealing cookies from Chrome, Firefox, Opera and Edge; uploading and downloading files; and snooping through and stealing documents.
"TAG has observed SPICA being used as early as September 2023, but believe that COLDRIVER's use of the backdoor goes back to at least November 2022," the Chocolate Factory's threat hunting team said in an [5]analysis published today.
[6]
SPICA is the first custom malware that TAG attributes to the Kremlin-backed group.
In addition to publishing details about the backdoor and how the campaign works, the Chocolate Factory also posted an extensive list of indicators of compromise including hashes, the SPICA sample name, and C2 address.
These expeditions tend to be highly targeted, focusing on "high-profile individuals in NGOs, former intelligence and military officials, defense, and NATO governments," Google TAG's Billy Leonard told The Register .
[7]
"TAG has only observed SPICA used in a very small number of campaigns, targeting a small number of organizations and individuals," Leonard said.
To deliver the malware, COLRIVER relies on its older, tried-and-true tactics.
[8]Five Eyes nations warn Moscow's mates at the Star Blizzard gang have new phishing targets
[9]Sandworm's Kyivstar attack should serve as a reminder of the Kremlin crew's 'global reach'
[10]Ivanti zero-day exploits explode as bevy of attackers get in on the act
[11]Secret multimillion-dollar cryptojacker snared by Ukrainian police
The criminals research their targets on social media, creating fake profiles and messaging their marks to build rapport.
They also use web-based email accounts that impersonate someone the target knows or a well-known industry figure, and go after high-profile individuals' personal email accounts, which are usually less protected than the same individuals' official government inboxes.
Just last month the Five Eyes' government agencies and Microsoft issued [12]separate reports about COLDRIVER's increasingly sophisticated evasion techniques and phishing tactics.
"As far back as November 2022, TAG has observed COLDRIVER sending targets benign PDF documents from impersonation accounts," the Chocolate Factory said in today's account of the gang's evolving espionage efforts.
The crew impersonates email addresses to trick victims into believing these documents are op-eds, or some other article for publication. The victim, we're told, can't open the benign PDF, which appears to be encrypted.
It's not, but this usually prompts a return email from the victim saying they can't open the doc. Then the phony email account responds with a link to a "decryption" utility that is actually the SPICA backdoor.
While the threat hunters were only able to snag one instance of the malware to analyze, they believe there are multiple versions of SPICA, each using a different decoy PDF. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2022/02/23/us_sanctions_russia/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZalZPmT@GgReI3ybYSZxSwAAAUU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/12/08/five_eyes_star_blizzard_warning/
[9] https://www.theregister.com/2024/01/05/sandworm_kyivstar_hack/
[10] https://www.theregister.com/2024/01/16/ivanti_zeroday_exploits_explode_into/
[11] https://www.theregister.com/2024/01/12/secret_multimilliondollar_cryptojacker_snared_by/
[12] https://www.theregister.com/2023/12/08/five_eyes_star_blizzard_warning/
[13] https://whitepapers.theregister.com/
Dinanziame
The victim, we're told, can't open the benign PDF, which appears to be encrypted. It's not, but this usually prompts a return email from the victim saying they can't open the doc. Then the phony email account responds with a link to a "decryption" utility that is actually the SPICA backdoor.
Oh come on
Omnipresent
You think this is the only way it's being used? How many official "fed ex" and delivery service emails did you get over the holiday with links to follow your package? I once plugged in my iphone to back up to a mac, and the mac told me to download a utility for an older phone first... it was a mac, so I just clicked without thinking..... The truth is people are being attacked all the time, and the attackers are out on social, and other platforms (game chats etc) telling people "not to worry, they are not the target", and people are so reliant on the machine they have to believe it. The truth is the people are very much the targets, and the bad guys have data based everything they are by now.... right down to mapping out their houses. They have profiled you in ways you didn't know existed. You are being attacked from every angle all the time. By ad agencies, tech firms, socials, AI, foreign actors..... anything that has an interest in profiling you, has you.
Want to know why?
Want to know why you feel like you are living in a sim? Russia, N korea, China, and Iran have been at war with the world since 2016 when they got the Orange florida terrorist installed through social media.