Dark River. You can’t see them, but they’re there

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – Initial vector attributed to a phishing email with a DOCX containing an exploit for CVE-2021-40444 (‘The content of this document was relevant to the field of operations of the targeted enterprise. This document contained an exploit for the CVE-2021-40444 vulnerability.’).
• [T1204.002] User Execution: Malicious File – The DOCX social‑engineered users to “enable editing” to trigger payload download and exploit execution (‘All the letters encouraged the user to enable editing in the document, which is a necessary condition for running the exploit.’).
• [T1218.010/T1218.011] System Binary Proxy Execution: Regsvr32 / Rundll32 – Backdoor DLL exports DllRegisterServer and DllMain to allow execution via Regsvr32/Rundll32 (‘exports the DllRegisterServer function … run when called through the standard Windows Regsvr32 program’).
• [T1543.003] Create or Modify System Process: Windows Service – Persistence is achieved by installing a loader service (Windows service) that launches the backdoor on startup (‘the backdoor is run using an additional component called loader service, which is a Windows service that runs automatically when the system starts’).
• [T1027.002] Obfuscated Files or Information: Software Packing – Samples were protected with Themida and contained virtualized handlers to impede analysis (‘the identified executable files and libraries were processed by the Themida protector to make them more difficult to detect and analyze’).
• [T1620] Reflective Code Loading – Backdoor reflectively loads PE modules for plugins into its process memory (‘The specified PE module is reflectively loaded into the address space of the backdoor process’).
• [T1552.001] Unsecured Credentials: Credentials In Files – Auth uses embedded keys/certificates (EdDSA keys) for client authentication stored in configuration (‘The private key is defined in the transport configuration… public key for validation is a hard-coded array’).
• [T1572] Protocol Tunneling – Builds hierarchical layered transports and tunnels application protocols over session and transport layers for C2 (‘MataDoor builds a hierarchical system of protocols, where a lower layer encapsulates a higher one, thus tunneling the traffic’).
• [T1090.003] Proxy: Multi-hop Proxy – Bridge/Bridge plugin implements relay nodes and multi-hop proxying allowing chaining of connections (‘Bridge facilitates various types of proxy connections, serving as a relay node … can set up data exchange between the backdoor and an operator via relay nodes’).
• [T1041] Exfiltration Over C2 Channel – File transfer commands support chunked upload/download and directory synchronization to exfiltrate data via the C2 channel (‘Command with ID = 301 … send to the C2 information about the file along with its contents starting from the offset’).
• [T1572.001/T1572.002] Encrypted Channel: Symmetric/Asymmetric – Session encryption uses RC4 for bulk and WolfSSL (TLS) for session protection; ECDHE used for key agreement (‘The data is encrypted with an RC4 session key… contains a statically linked WolfSSL library’).