CommonMagic Malware Implants Linked to New CloudWizard Framework

The CommonMagic malware implant has been related with a previously mysterious state-of-the-art persistent threat campaign joined to the Russo-Ukrainian conflict and relies on a new modular framework.

Dubbed “CloudWizard,” the framework was identified by security scientists at Kaspersky, who explained it in an advisory printed right now.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Leonid Bezvershenko, Georgy Kucherin and Igor Kuznetsov highlighted that sections of the CloudWizard code were being identical to CommonMagic as they employed the same encryption library, adopted a similar file naming format and shared sufferer places.

Study additional on Russia’s cyber-attack strategy in Ukraine: Russian Cyber Offensive Displays ‘Unprecedented’ Pace and Agility

The same energetic danger actor is also thought to be accountable for the destructive campaigns acknowledged as Procedure Groundbait and Procedure BugDrop.

The researchers stated CloudWizard victims were being not confined to the Donetsk, Lugansk and Crimea locations of Ukraine but also involved central and western areas. The targets encompassed folks, diplomatic entities and investigation organizations.

CloudWizard offers 9 modules, collectively delivering different hacking abilities, together with file gathering, keylogging, screenshot capture, microphone enter recording and password theft. It can also extract Gmail cookies from browser databases and then entry and smuggle exercise logs, speak to lists and all email messages linked with the targeted accounts.

“The threat actor accountable for these operations has shown a persistent and ongoing motivation to cyber-espionage, continuously boosting their toolset and focusing on corporations of fascination for about fifteen many years,” Kucherin said, commenting on the conclusions.

“Geopolitical elements continue on to be a considerable motivator for APT attacks and, offered the prevailing tension in the Russo-Ukrainian conflict spot, we foresee that this actor will persist with its operations for the foreseeable potential.”

The Kaspersky report comes a couple of months after the Russian government announced that officials would no more time be ready to use messaging apps designed and run by international businesses allegedly in a bid to lower the likelihood of delicate data achieving Ukraine’s allies.