Russian Turla Hackers Hijack Decade-Old Malware Infrastructure to Deploy New Backdoors

The Russian cyberespionage team recognized as Turla has been observed piggybacking on attack infrastructure utilized by a decade-previous malware to deliver its possess reconnaissance and backdoor applications to targets in Ukraine.

Google-owned Mandiant, which is tracking the procedure less than the uncategorized cluster moniker UNC4210, reported the hijacked servers correspond to a variant of a commodity malware called ANDROMEDA (aka Gamarue) that was uploaded to VirusTotal in 2013.

“UNC4210 re-registered at least 3 expired ANDROMEDA command-and-command (C2) domains and started profiling victims to selectively deploy KOPILUWAK and QUIETCANARY in September 2022,” Mandiant researchers explained in an analysis posted final 7 days.

Turla, also recognized by the names Iron Hunter, Krypton, Uroburos, Venomous Bear, and Waterbug, is an elite nation-point out outfit that largely targets govt, diplomatic, and military services companies applying a big established of tailor made malware.

Due to the fact the onset of Russia’s army invasion of Ukraine in February 2022, the adversarial collective has been linked to a string of credential phishing and reconnaissance initiatives aimed at entities situated in the state.

In July 2022, Google’s Menace Investigation Team (TAG) discovered that Turla made a malicious Android application to supposedly “enable” pro-Ukrainian hacktivists launch distributed denial-of-service (DDoS) attacks towards Russian internet sites.

The most recent discovery from Mandiant demonstrates that Turla has been stealthily co-opting more mature infections as a malware distribution system, not to point out taking edge of the fact that ANDROMEDA spreads by using infected USB keys.

“USB spreading malware carries on to be a practical vector to gain first obtain into corporations,” the threat intelligence business reported.

In the incident analyzed by Mandiant, an contaminated USB stick is stated to have been inserted at an unnamed Ukrainian group in December 2021, finally primary to the deployment of a legacy ANDROMEDA artifact on the host upon launching a malicious hyperlink (.LNK) file masquerading as a folder within the USB travel.

The risk actor then repurposed a person of the dormant domains that were being element of ANDROMEDA’s defunct C2 infrastructure – which it re-registered in January 2022 – to profile the target by providing the initially-stage KOPILUWAK dropper, a JavaScript-dependent network reconnaissance utility.

Two times later, on September 8, 2022, the attack proceeded to the final phase with the execution of a .NET-primarily based implant dubbed QUIETCANARY (aka Tunnus), ensuing in the exfiltration of files established following January 1, 2021.

The tradecraft employed by Turla dovetails with prior experiences of the group’s intensive sufferer profiling efforts coinciding with the Russo-Ukrainian war, potentially supporting it tailor its adhere to-on exploitation efforts to harvest the data of desire to Russia.

It can be also 1 of the uncommon scenarios in which a hacking unit has been determined concentrating on victims of a diverse malware campaign to satisfy its individual strategic plans, though also obscuring its job.

“As older ANDROMEDA malware carries on to spread from compromised USB equipment, these re-registered domains pose a risk as new risk actors can get handle and deliver new malware to victims,” the scientists mentioned.

“This novel strategy of professing expired domains utilised by extensively distributed, economically motivated malware can enable observe-on compromises at a broad array of entities. Even further, more mature malware and infrastructure may well be extra probable to be missed by defenders triaging a vast assortment of alerts.”

COLDRIVER Targets U.S. Nuclear Exploration Labs

The conclusions also arrive as Reuters noted that one more Russian condition-sponsored danger team codenamed COLDRIVER (aka Callisto or SEABORGIUM) specific a few nuclear research labs in the U.S. in early 2022.

To that end, the electronic assaults entailed producing fake login pages for Brookhaven, Argonne, and Lawrence Livermore Countrywide Laboratories in an try to trick nuclear scientists into revealing their passwords.

The practices are steady with known COLDRIVER activity, which lately was unmasked spoofing the login internet pages of defense and intelligence consulting firms as nicely as NGOs, feel tanks, and better education entities in the U.K. and the U.S.

Identified this post interesting? Comply with us on Twitter  and LinkedIn to examine a lot more unique written content we publish.

Some areas of this short article are sourced from:
thehackernews.com