State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage – Check Point Research

MITRE Techniques

• [T1566.001] Phishing – Spear-phishing emails using the Russia-Ukraine war as lure. “The attackers use decoys ranging from official-looking documents to news articles or even job postings, depending on targets and region.”
• [T1204.002] User Execution – Malicious macros in lure documents to gain initial foothold. “The lure documents utilize malicious macros or template injection to gain an initial foothold into the targeted organizations, and then launch malware attacks.”
• [T1059.005] VBScript – The malware executes encoded VBScript via wscript.exe after the macro drops a .vbe file. “The macro then launches the wscript.exe to execute the .vbe file.”
• [T1059.006] Python – The payloads are primarily written in Python with multiple interpreters masquerading as Adobe-related executables. “The malware is primarily written in Python, and comes with two different Python interpreters…”
• [T1053.005] Scheduled Task – Persistence via a scheduled task that runs every 5 minutes, masquerading as an Adobe Update. “The task executes the AdobeReaderUpdate script, a customized version of Loki.Rat…”
• [T1221] Template Injection – Remote template injection used in lure documents (SideWinder). “remote template injection” and exploitation of CVE-2017-11882 are described as part of the infection chain.
• [T1071.001] Web Protocols – C2 communication over web channels, including BlogSpot hosting and obfuscated JSON payloads. “The data is submitted to the C&C server in a somewhat obfuscated but consistent JSON format” and use of BlogSpot-based URLs.
• [T1071.004] DNS – DNS tunneling for C2 communication observed in Lyceum campaigns. “The DNS tunneling technique in the C&C communication widely used in previous Lyceum campaigns.”
• [T1113] Screen Capture – The backdoors perform screenshots as part of reconnaissance. “Take screenshots.”
• [T1083] File and Directory Discovery – Drops and collects file lists/sizes on drives to identify targets. “collect information about the files on each drive – collect file names and file sizes…”
• [T1027.002] Obfuscated/Compressed Files and Information – Base64 encoding used to obfuscate payloads. “Each of the Python script files is obfuscated using base64 encoding.”