Darth Vidar: Evolution of Threat Infrastructure at Team Cymru

MITRE Techniques

• [T1090.004] Multi-hop Proxy – Vidar uses VPN gateways and Tor to anonymize operators; “Russian VPN gateways are potentially providing anonymity for Vidar operators / customers, making it more challenging for analysts to have a complete overview of this threat. These gateways now appear to be migrating to Tor.”
• [T1583] Acquire Infrastructure – Vidar operators appear to be expanding their infrastructure, so analysts need to keep them in their sights. We expect a new wave of customers and as a result, an increase of campaigns in the upcoming weeks.
• [T1105] Ingress Tool Transfer – A bash script which is run on the user / customer VPS server to download all the web-server requirements for the set up of a new Vidar campaign.
• [T1071.001] Web Protocols – The proxy_pass IP is used to route traffic to TCP/80 on 185.173.93.98 (ADMAN-AS, RU), an IP which also receives inbound connections from two further IPs assigned to ‘ProManaged LLC’.
• [T1566] Phishing – Delivery methodology for Vidar has varied over time, utilizing email / phishing lures and ‘poisoned’ cracked software targeting vendors such as AnyDesk and Windows, the latter leveraging SEO impersonation and YouTube videos to dupe users into downloading the malware.
• [T1078] Valid Accounts – This path contains the Vidar users (or customers) web portal, where access to a dashboard is provided for the management of payloads related to their campaigns, victim assets, etc.