An unknown APT group has targeted Russian government entities with at least four spear-phishing campaigns since late February 2022, aiming to install a Remote Access Trojan that can monitor and control infected machines. The operation blends sophisticated anti-analysis tricks with a Windows-based C2 framework, and attribution remains uncertain but leans toward a possible Chinese actor.
Keypoints
- Four or more spear-phishing campaigns have targeted Russian government entities since late February 2022, designed to deploy a Remote Access Trojan (RAT).
- Lures include: an interactive map of Ukraine, a fake Log4j patch, Rostec masquerading files, and a Saudi Aramco job advert with macro-enabled content.
- The malware family is a single, heavily obfuscated RAT (GE40BRmRLP.dll) used across campaigns, with VBScript dropper chains (UpdateRunner.vbs, HelpCenterUpdater.vbs) and rundll32 execution.
- Anti-analysis techniques are strong, including control-flow flattening and string XOR obfuscation; the sample appears LLVM/OLLVN-based and uses self-contained SSL via WolfSSL.
- C2 communications rely on HTTP(S) with TLS, unique machine IDs hashed by Blake2b-256, and raw sockets to conceal traffic; the malware can execute commands, upload files, and enumerate directories.
- Attribution is uncertain but suggests possible Chinese origin, with infrastructure overlaps to BL Networks and links to Sakula RAT; several macro and toolchain elements are noted as potential false flags.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – Campaign used spear-phishing emails with attachments and a subject in content related to vulnerabilities. ‘Rostec. FSB RF. Roskomnadzor. Urgent Vulnerability Fixes’
- [T1059.005] Visual Basic – VBScript-based dropper chain (UpdateRunner.vbs/HelpCenterUpdater.vbs) used to drop and execute payloads. ‘The job of the UpdateRunner.vbs script is to execute the DLL through rundll32.exe.’
- [T1083] File and Directory Discovery – The malware enumerates files with FindFirstFile/FindNextFile to list directory contents. ‘FindFirstFile and FindNextFile function to retrieve a list of all the files under the directory.’
- [T1105] Ingress Tool Transfer – Main payload downloaded from the C2 server (GE40BRmRLP.dll). ‘downloads the main payload—a DLL named GE40BRmRLP.dll—from its command and control (C2) server.’
- [T1027] Obfuscated/Compressed Files and Information – The DLL is heavily obfuscated with XOR-encoded strings and control-flow flattening. ‘The payload’s strings are obfuscated with simple XOR encoding.’
- [T1071.001] Web Protocols – C2 communication uses HTTP(S) GET requests and TLS via WolfSSL; talks to the C2 with encoded data. ‘GET requests in the form url/?wSR=’
- [T1059.003] Windows Command Shell – The loader uses CreateProcessA for command execution and rundll32 to run payloads, indicating command execution workflows. ‘CreateProcessA’ and ‘rundll32.exe’
- [T1566.002] Masquerading – Files are named to resemble legitimate software (e.g., build_rosteh4.exe) to look like Rostec software. ‘an apparent attempt to make it look like software from Rostec’
- [T1204.002] User Execution – The Saudi Aramco campaign relied on a macro-enabled document and a prompt to enable macros. ‘a message in Russian, asking users to enable macros.’
Indicators of Compromise
- [Domain] C2 Domains – windowsipdate[.]com, microsftupdetes[.]com, mirror-exchange[.]com
- [IP] C2 IPs – 168.100.11.142, 192.153.57.83, 45.61.137.211, 206.188.197.35
- [Domain] Download Domain – fatobara[.]com
- [IP] Download IP – 91.210.104.54
- [File Name] Payload-related files – interactive_map_UA.exe, Patch_Log4j.tar.gz, build_rosteh4.exe, GE40BRmRLP.dll
- [Hash] Final payload – cbde42990e53f5af37e6f6a9fd14714333b45498978a7971610acb640ddd5541, 86ecd536c84cec6fc07c4cb3db63faa84f966a95763d855c7f6d7207d672911e, 917820338751b08cefc635090fc23b4556fa77b9007a8f5d72c11e0453bfec95, 22bdc42a86d3c70a01c51f20f5b7cfb353319691a8102f0fe3ea02af9079653e, 12c20f9dbdb8955f3f88e28dc10241f35659dbcd74dadc9a10ca1b508722d69a, 3f16055dc0f79f34f7644cae21dfe92ffc80f2c3839340a7beebd9436da5d0eb, f5658588c36871421f287f12e7e9ba5afba783a7003da1043a9c52d10354b909, ca95e8a8b6fb11b5129821f034b337b06cdf407fa9516619f3baed450ac1cf2d, bac1790efe7618c5b2b9e34e6e1d36ec51592869bcc5fb304dd7554c32731093, 5d039f4368f88a2299be91303c03143e340f700f1fc8aa0a8cdbfbc5a193c6be