Bad magic: new APT found in the area of Russo-Ukrainian conflict

MITRE Techniques

• [T1566.002] Phishing: Spearphishing Link – The victims navigated to a URL pointing to a ZIP archive hosted on a malicious web server. The archive, in turn, contained two files: “The victims navigated to a URL pointing to a ZIP archive hosted on a malicious web server. The archive, in turn, contained two files:”
• [T1204.002] User Execution: Malicious File – a malicious LNK file with a double extension (e.g., .pdf.lnk) that leads to infection when opened. “a malicious LNK file with a double extension (e.g., .pdf.lnk) that leads to infection when opened”
• [T1218.005] Signed Binary Proxy Execution: Msiexec – The MSI file is downloaded and started by the Windows Installer executable. “The MSI file is effectively a dropper package, containing an encrypted next-stage payload (service_pack.dat), a dropper script (runservice_pack.vbs) and a decoy document that is supposed to be displayed to the victim.”
• [T1027] Obfuscated/Encrypted Files and Information – Decryption of service_pack.dat using a multi-step XOR routine before execution. “The decrypted payload is obtained by decrypting service_pack.dat via an XOR-based scheme.”
• [T1059.001] Command and Scripting Interpreter: PowerShell – The dropper’s embedded PowerShell decrypts and runs the next stage. “a wrapper for launching an embedded PowerShell script that decrypts the next stage using a simple one-byte XOR, launches it and deletes it from disk.”
• [T1053.005] Scheduled Task – Creation of a daily Task Scheduler job WindowsActiveXTaskTrigger to execute the VBS launcher. “creates a Task Scheduler job named WindowsActiveXTaskTrigger, to execute the
  • [T1071.001] Web Protocols – C2 over cloud storage via OneDrive/Graph API for command and control. “The framework uses OneDrive remote folders as a transport. It utilizes the Microsoft Graph API using an OAuth refresh token embedded into the module binary for authentication.”
  • [T1071.004] Web Protocols: Cloud Storage – Data exchange with the operator through cloud services (OneDrive/Dropbox) and RC5Simple-based encryption. “The data exchanged with the operator via the OneDrive location is encrypted using the RC5Simple open-source library.”