Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

MITRE Techniques

• [T1566.001] Phishing – Spearphishing Attachment – Initial access via phishing emails with an attached archive containing a shortcut file and a decoy PDF. ‘The initial attack vectors are phishing emails with a file attached, which usually consists of an archive consisting of two files: a shortcut file and a decoy PDF file.’
• [T1105] Ingress Tool Transfer – LNKs download and execute a remote HTA via mshta.exe. ‘The malicious LNK files are simple downloaders that employ mshta.exe to download and execute a remote HTA file on the infected endpoint.’
• [T1218.005] HTML Application – HTA delivery of payloads – HTA downloads decoy documents and dropper implants. ‘HTA downloads decoy documents and dropper implants.’
• [T1059.001] PowerShell – Command and Scripting Interpreter – Execution of payloads through PowerShell-based commands. ‘All these tasks are accomplished by running PowerShell-based commands.’
• [T1059.006] Python – Python-based malware tooling – Custom Python-based information stealers and RATs, often packed into executables. ‘Custom Python-based information stealers’ and ‘Python-based information stealers… wrapped up into an executable using frameworks such as Nuitka or PyInstaller.’
• [T1027] Obfuscated/Compressed Files – Packaging Python payloads into executables (Nuitka/PyInstaller) that may leak code. ‘wrapped up into an executable using frameworks such as Nuitka or PyInstaller.’
• [T1555.003] Credentials from Web Browsers – Stealers collect browser credentials (Chrome) and other data. ‘stolen data reveals credentials from multiple browsers’ and ‘Chrome browser credentials.’
• [T1071.001] Web Protocols – Telegram-based C2/Exfiltration – Malware uses Telegram bots to exfiltrate data or receive commands. ‘This bot was wrapped up into a .exe either using PyInstaller or Nuitka and then deployed in the field… Telegram bots to exfiltrate information or receive commands from the operator.’