Operation DupeHike : UNG0902 targets Russian employees with DUPERUNNER and AdaptixC2 | Seqrite

MITRE Techniques

• [T1566.001 ] Spearphishing Attachment – Malicious ZIP delivered to targets containing a PDF-themed LNK lure used for initial access. (‘Victims receive ZIP file containing malicious PDF-themed LNK lure (employee bonus policy).’)
• [T1204.002 ] User Execution: Malicious File – Victims open the LNK believing it is a PDF, triggering execution. (‘User opens LNK file thinking it is a PDF, triggering execution.’)
• [T1059.001 ] PowerShell – LNK invokes PowerShell with hidden flags to download and run DUPERUNNER. (‘LNK launches PowerShell with -NoNI -nop -w hidden to download and execute DUPERUNNER from C2.’)
• [T1218.011 ] System Binary Proxy Execution / LOLBIN Execution – Legitimate system binaries (powershell.exe) are used to proxy execution of malicious components. (‘powershell.exe … to run completely in the background’)
• [T1105 ] Ingress Tool Transfer – Files are fetched from remote servers via Invoke-WebRequest (iwr) and saved to Temp (s.exe, fontawesome.woff). (‘PowerShell Invoke-WebRequest (iwr) downloads s.exe (DUPERUNNER) and later fontawesome.woff (AdaptixC2 stager).’)
• [T1036 ] Masquerading – Malicious artifacts masquerade as benign files (LNK as PDF, WOFF as font, DLL/PE appended to shellcode). (‘LNK posed as PDF, DLL posing as ZIP, WOFF posing as a font file.’)
• [T1027 ] Obfuscated/Encrypted File – AdaptixC2 uses packed shellcode appended behind magic bytes to hide payload. (‘AdaptixC2 uses packed shellcode appended behind magic bytes (EZ).’)
• [T1027.007 ] Dynamic API Resolution – AdaptixC2 resolves APIs at runtime using custom hashing and PEB traversal. (‘AdaptixC2 resolves APIs using djb2-style hashing and PEB traversal.’)
• [T1055.003 ] Thread Execution Hijacking – DUPERUNNER injects shellcode into legitimate processes (explorer.exe, notepad.exe, msedge.exe) using remote-thread injection. (‘DUPERUNNER injects shellcode into legitimate processes (explorer.exe, notepad.exe, msedge.exe).’)
• [T1620 ] Reflective Code Loading – The stager locates an appended PE via magic bytes and loads it reflectively into memory. (‘AdaptixC2 loads its payload from appended shellcode using reflective loading techniques.’)
• [T1082 ] System Information Discovery – DUPERUNNER enumerates system time, Temp directory, hostname and creates a victim GUID for profiling. (‘DUPERUNNER gathers hostname, domain, system time, Temp directory, creates victim GUID.’)
• [T1057 ] Process Discovery – The implant enumerates running processes to select injection targets using CreateToolHelp. (‘DUPERUNNER enumerates processes (explorer.exe, notepad.exe, msedge.exe) using CreateToolHelp API.’)
• [T1071.001 ] Application Layer Protocol: HTTP – Beaconing and downloads use HTTP GET/POST to communicate with C2 (46.149.71.230). (‘DUPERUNNER uses HTTP GET to download decoy and beacon from 46.149.71.230.’)
• [T1132 ] Data Encoding – Beacon data and command results are encoded before transmission. (‘Beacon results and communications encoded via internal routines.’)
• [T1095 ] Non-Application Layer Protocol – AdaptixC2 may use raw TCP or non-standard protocols for beaconing as implied by its design. (‘AdaptixC2 may use raw TCP for beaconing (implied from C2 design).’)
• [T1573 ] Encrypted Communication – C2 communications are protected by encryption in the AdaptixC2 beacon. (‘AdaptixC2 beacon uses encryption during C2 communications.’)
• [T1055 ] Process Injection – DUPERUNNER uses Remote-Thread Injection to execute the next-stage shellcode in target processes. (‘DUPERUNNER injects AdaptixC2 shellcode into legitimate processes via Remote Thread Injection.’)
• [T1113 / T1005 ] Local Data Collection – The beacon can retrieve system files and local data as instructed by the operator. (‘Beacon capable of retrieving system files as instructed by TA.’)
• [T1041 ] Exfiltration Over C2 Channel – Collected data and command outputs are exfiltrated to the /result C2 endpoint via POST. (‘Beacon sends encoded results/output to /result C2 endpoint via POST.’)
• [T1537 ] Data Exfiltration – Operation results in theft of system files and corporate data from targeted Russian environments. (‘Steals system data and files from Russian corporate environments.’)