Malware Disguised as Document from Ukraine’s Energoatom Delivers Havoc Demon Backdoor | FortiGuard Labs

MITRE Techniques

• [T1059.005] Visual Basic – The macro executes and hides its code, with the VBA macro designed to run when the document is opened. Quote: “The macro begins by deleting the overlay image… [and] is set to execute when the document is opened via AutoOpen and Document_Open events.”
• [T1027] Obfuscated/Compressed Data – The document encodes and decodes strings by subtracting 35, Base64 encoding, and other tricks to hide strings. Quote: “encoding by subtracting 35 from each character of the original string and encoding the result with Base64.”
• [T1036] Masquerading – The payload pretends to be a legitimate Office component (OfficeTelemetry.dll) and is delivered under a Microsoft Office-like guise. Quote: “masquerade as a legitimate component of Microsoft Office.”
• [T1106] Native API – The KaynLdr stage resolves native APIs via API hashing (LdrLoadDll, ZwAllocateVirtualMemory, NtProtectVirtualMemory) to allocate memory, load the payload, and execute in memory. Quote: “KaynLdr resolves the LdrLoadDll, ZwAllocateVirtualMemory, and NtProtectVirtualMemory Native APIs via API hashing.”
• [T1055] Process Injection – The loader creates a new suspended injection thread to run the payload, hiding from debuggers. Quote: “the loader calls ZwCreateThreadEx to create a new suspended injection thread hidden from debuggers.”
• [T1059.003] Windows Command Shell – The loader launches the shellcode via conhost.exe (headless), effectively using a command shell proxy to start the payload. Quote: “ShellExecute with the following command line: ‘C:WindowsSystem32conhost.exe –headless’.”
• [T1086] PowerShell – The Havoc Demon suite lists PowerShell command execution as a capability, indicating extensibility beyond VBA. Quote: “Execute PowerShell commands” as part of major features.
• [T1573] Encrypted Channel – Havoc Demon encrypts communications with AES-256-CTR, sharing a key/IV with the C2 on initial check-in. Quote: “…encrypted payload data… AES-256-CTR.”
• [T1071.001] Web Protocols – Havoc Demon communicates with its C2 over HTTP/HTTPS POST requests to ukrtatnafta.org. Quote: “Demon communicates with the C2 server specified in the configuration via HTTP or HTTPS POST requests.”
• [T1562.001] Impair Defenses – The loader patches security-related APIs (WldpQueryDynamicCodeTrust, AmsiScanBuffer, EtwEventWrite) to hinder detection. Quote: “patches security-related APIs to disable them.”
• [T1036] Cobalt Strike Clue – The sample contains plaintext Cobalt Strike configuration field names, which could mislead analyzers. Quote: “well-known Cobalt Strike configuration field names… found in plaintext.”