Pro-Russian Group Targeting Ukraine Supporters with DDoS Attacks – Avast Threat Labs

MITRE Techniques

• [T1071] Web Protocols – The bots communicate with C2 over HTTP via unsecured requests; “The communication between Bobik bots and the C&C servers is mediated using a simple unsecured HTTP request and response via the Nginx web server.”
• [T1055] Process Injection – Bobik’s RuntimeBroker is injected into another process; “injected into the newly created process of the .NET ClickOnce Launch Utility (AppLaunch.exe)”;
• [T1027] Obfuscated/Compressed Files and Information – The RedLine Stealer Cryptic installer deobfuscates the .NET payload and helps drop Bobik components; “The RedLine Stealer Cryptic (installer) deobfuscates the .NET payload of Bobik’s Updater…”
• [T1105] Ingress Tool Transfer – The final DDoS module deployment flows through Bobik’s Updater dropped by RedLine Stealer; “The first executes Bobik’s Updater via a RedLine Stealer bot. In the second stage, Bobik’s Updater extracts and drops the final DDoS module…”
• [T1082] System Information Discovery – Bobik collects system information to generate a victim-specific ID used in communications; “Win32_DiskDrive, Win32_Processor, Win32_BaseBoard, etc.”
• [T1056.001] Keylogging – Bobik’s spyware includes keylogging among its capabilities; “spyware functionalities include keylogging, running and terminating processes, collecting system information, downloading/uploading files…”