APT31 Targeted Russian IT Firms With New Malware and Cloud-Based C2
Summary
An investigation links APT31 to prolonged attacks on Russian IT firms in 2024–2025, detailing phishing, credential theft, lateral movement, new malware, and abuse of cloud services for command-and-control and data exfiltration.
Key points
- The researchers linked attacks on Russian IT companies, including government contractors and systems integrators, to APT31; some intrusions persisted for years.
- A December 2024 phishing campaign used a procurement-themed email and malicious LNK files to deliver CloudyLoader through DLL sideloading.
- APT31 used tools including LocalPlugx, CloudSorcerer, AufTime, COFFProxy, VtChatter, OneDriveDoor, and YaLeak across Windows and Linux systems.
- The attackers used legitimate services such as Microsoft OneDrive, Yandex, VirusTotal, and Microsoft dev tunnels for command-and-control, tunneling, or data transfer.
- Techniques included scheduled-task persistence, credential theft, keylogging, hidden tasks, log clearing, and lateral movement using Impacket and RDP.
- YaLeak uploaded victim files to Yandex Disk and deleted local copies after successful uploads; the researchers report theft of sensitive files and credentials.
Article Details
- Attack Vectors
- A December 2024 phishing email impersonated a procurement manager and attached Требования.rar. Its LNK file opened lure documents and initiated DLL sideloading.
- A separate malicious archive, Seguro_de_lMRE.zip, appears to have been downloaded in Peru. Its shortcut displayed a financial-report lure and launched a legitimate executable that loaded a malicious DLL.
- Persistence used scheduled tasks disguised as legitimate software. Some tasks were hidden by removing their registry security descriptor and XML task file.
- A scheduled task launched the Windows OOBE executable with an argument that triggered execution of an attacker-modified ErrorHandler.cmd.
- Encrypted VPN connections and public development tunnels exposed internal services and carried malware traffic through legitimate infrastructure.
- Lateral movement used newly created local administrator accounts, WMI, SMB-based execution, RDP, and pass-the-hash authentication.
- Credential collection included exported registry hives, browser credentials and cookies, keylogging, clipboard capture, and interception of webmail sign-in credentials.
- Malware used cloud storage, social-network profiles, repository resources, and file comments as command or payload channels.
- Files were uploaded to attacker-controlled cloud storage and deleted locally after successful exfiltration.
- Defensive Notes
- The researchers describe detection of hidden scheduled tasks by checking for missing task files, deleted security descriptors, and modified task indexes.
- The source reports that a signed telemetry-collection utility includes a module for detecting these hidden-task conditions on investigated hosts.
- Decrypted keylogger and clipboard logs allowed investigators to reconstruct attacker commands. Clipboard records supported the assessment that the attackers followed a prepared command sequence.
- The article notes that traffic to legitimate cloud and development-tunnel services can blend with normal activity and bypass traditional perimeter controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | moeodincovo[.]com | C2 domain configured in the Cobalt Strike Beacon downloaded by CloudyLoader. |
planningmid@mail[.]ru | Email address recorded for the attacker-associated VirusTotal account planningmid. | |
| HOSTNAME | www[.]moeodincovo[.]com | C2 hostname configured in the Cobalt Strike Beacon downloaded by CloudyLoader. |
| MD5 | e6e73c59eb8be5fa2605b17552179c2f | MD5 of CloudyLoader's decrypted main DLL payload. |
| MD5 | fe7aa97fbe3fe21e59ead1792ca2dc58 | PublicKey_MD5 value reported in the configuration of the downloaded Cobalt Strike Beacon. |
| SHA1 | 7a3139e80ea8c9d4bebf537d5497e19b3169ac09 | SHA1 of CloudyLoader's decrypted main DLL payload. |
| SHA256 | 4f53a5972fca15a04dc9f75f8046325093e9505a67ba90552100f6ad20c98f8b | SHA256 of CloudyLoader's decrypted main DLL payload. |
| SHA256 | 90d2d1af406bdca41b14c303e6525dfc65565883bf2d4bf76330aa37db69eceb | VirusTotal file identifier on which the attackers posted comments in the VtChatter investigation. |
| SHA256 | adc9bf081e1e9da2fbec962ae11212808e642096a9788159ac0acef879fd31e8 | VirusTotal file identifier embedded in VtChatter; comments on this file served as its bidirectional C2 channel. |
| SHA256 | f506898cc7c2e092f9eb9fadae7ba50383f5b46a2a4fe5597dbb553a78981268 | VirusTotal file identifier on which the attackers posted comments in the VtChatter investigation. |
| URL | hxxps[:]//github[.]com/Range1992/scrcpyClone/raw/refs/heads/master/app/deps/PersonalizationCSP | Specific attacker-controlled GitHub resource used to download an encrypted CobaltStrike implant. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/Range1992/scrcpyClone/refs/heads/master/app/data/zsh-completion/_scrcpy | Attacker-created repository resource containing an encrypted payload URL retrieved by CloudyLoader. |
| URL | hxxps[:]//virustotal[.]com/api/v3/files/adc9bf081e1e9da2fbec962ae11212808e642096a9788159ac0acef879fd31e8/comments | Specific VirusTotal comments resource used by VtChatter to receive commands and post command output. |
| URL | hxxps[:]//www[.]virustotal[.]com/api/v3/users/planningmid | Specific VirusTotal account resource associated with the attacker token used for VtChatter activity. |
MITRE ATT&CK
T1003 · OS Credential DumpingAttackers exported registry hives and used the Impacket utility identified as secretdump.py to extract credential data.T1005 · Data from Local SystemStickyNotesExtract.exe extracted the Windows Sticky Notes database, and malware collected local files for transfer.T1016 · System Network Configuration DiscoveryAufTime collected LAN address information, and OneDriveDoor reported the infected host's IP address.T1018 · Remote System DiscoverySharpADUserIP and an RDP-event PowerShell script extracted connection IP addresses from host logs for infrastructure discovery.T1021.001 · Remote Desktop ProtocolAttackers used RDP for lateral movement, including Restricted Admin Mode in a pass-the-hash command.T1021.002 · SMB/Windows Admin SharesAPT31 used Impacket SmbExec for lateral movement within compromised networks.T1027.002 · Software PackingMalicious DLLs used VMProtect, and the Linux COFFProxy variant was obfuscated with Garble.T1027.007 · Dynamic API ResolutionCloudyLoader resolved Windows APIs and syscall functions using hashed function names.T1033 · System Owner/User DiscoveryBackdoors collected usernames, and VtChatter's demonstrated C2 command executed whoami.T1036.005 · Match Legitimate Resource Name or LocationScheduled tasks used legitimate-software-like names, and AufTime changed its command-line representation to imitate Linux system processes.T1041 · Exfiltration Over C2 ChannelAufTime, COFFProxy, and OneDriveDoor supported sending victim file contents through their C2 channels.T1046 · Network Service DiscoveryAPT31 used Advanced IP Scanner to identify devices across the compromised environment.T1047 · Windows Management InstrumentationAPT31 used Impacket WmiExec for lateral execution, and OneDriveDoor implemented process operations through IWbemLocator.T1053.005 · Scheduled TaskAPT31 used scheduled tasks for persistence, periodic VtChatter execution, public dev tunnels, and OOBE-triggered payload execution.T1055 · Process InjectionLocalPlugx injected into Windows processes; COFFProxy injected into audiodg.exe, CloudyLoader into makecab.exe, and OneDriveDoor into winrshost.exe.T1056.001 · KeyloggingLocalPlugx's keylogger intercepted input and recorded keystrokes in ntuser.dat.LOG1.T1056.003 · Web Portal CaptureOWOWA intercepted Outlook on the web sign-in credentials through IIS request and response handlers.T1057 · Process DiscoveryOneDriveDoor's tasklist plugin queried Win32_Process for process names and IDs.T1059.001 · PowerShellAttackers ran a PowerShell Get-WinEvent script to extract usernames and IP addresses from RDP logon events.T1059.003 · Windows Command ShellLNK files invoked cmd.exe; OneDriveDoor also supported commands executed through a running cmd process.T1059.004 · Unix ShellAufTime supported reverse shells and sh -c execution; the Linux COFFProxy variant executed bash commands.T1069.001 · Local GroupsOneDriveDoor's localgroup implementation enumerated local groups.T1070.001 · Clear Windows Event LogsAttackers cleared Windows event logs using the utility identified in the article as wevutil.T1070.004 · File DeletionAttackers deleted working-directory files and scheduled-task XML files; YaLeak deleted local files after successful uploads.T1071.001 · Web ProtocolsVtChatter used HTTP API requests for C2, and the downloaded Cobalt Strike Beacon was configured for HTTPS.T1082 · System Information DiscoveryAufTime collected hostname and operating-system information; OneDriveDoor collected computer identity, PID, working directory, and administrator status.T1083 · File and Directory DiscoverySharpDir.exe searched files, and OneDriveDoor recursively enumerated directory contents, modification times, sizes, and attributes.T1087.001 · Local AccountOneDriveDoor's net user implementation could enumerate local users with detailed account information.T1090 · ProxyAufTime implemented SOCKS5 proxying, while COFFProxy and LocalPlugx supported proxy connections and traffic forwarding.T1102.002 · Bidirectional CommunicationVtChatter exchanged commands and output through VirusTotal comments, while cloud-backed malware used legitimate storage services for bidirectional C2.T1105 · Ingress Tool TransferCloudyLoader downloaded an encrypted implant from an attacker-created GitHub repository; attackers also copied tools from an internal shared drive.T1112 · Modify RegistryAttackers deleted scheduled-task SecurityDescriptor properties from the TaskCache registry tree to hide tasks.T1115 · Clipboard DataLocalPlugx recorded clipboard contents in ntuser.dat.LOG2, including commands pasted by the attackers.T1134.001 · Token Impersonation/TheftNative COFFProxy supported privilege elevation for a specified session using ImpersonateLoggedOnUser.T1135 · Network Share DiscoveryOneDriveDoor's share implementation enumerated shared resources using NetShareEnum.T1136.001 · Local AccountAttackers created local administrator accounts on compromised hosts and used them for lateral movement.T1140 · Deobfuscate/Decode Files or InformationLoaders decrypted encrypted shellcode and payloads; CloudyLoader also decoded and decrypted the repository-hosted payload URL.T1204.002 · Malicious FileMalicious shortcuts in lure archives opened decoy documents and launched the DLL-sideloading execution chain.T1218.011 · Rundll32A scheduled task launched VtChatter's NVIDIADEBUG.dll export through rundll32.exe every two hours.T1505.004 · IIS ComponentsAttackers installed the malicious OWOWA IIS module after gaining access to the infrastructure.T1539 · Steal Web Session CookieSharpChrome.exe extracted browser cookies from Chrome and recent versions of Edge.T1550.002 · Pass the HashA recovered Mimikatz command used sekurlsa::pth with an NTLM hash to launch RDP in Restricted Admin Mode.T1555.003 · Credentials from Web BrowsersSharpChrome.exe extracted credentials from Chrome and recent versions of Edge.T1562.004 · Disable or Modify System FirewallAttackers added an inbound TCP firewall rule for a LocalPlugx listening port.T1566.001 · Spearphishing AttachmentAPT31 sent a procurement-themed phishing email carrying Требования.rar with a malicious LNK file.T1567.002 · Exfiltration to Cloud StorageYaLeak recursively uploaded victim files to the attacker's Yandex Disk storage.T1572 · Protocol TunnelingTailscale VPN and Microsoft dev tunnels carried traffic between compromised hosts and attacker infrastructure.T1573.001 · Symmetric CryptographyCOFFProxy encrypted C2 messages with AES; VtChatter and OneDriveDoor encrypted their C2 messages with RC4.T1573.002 · Asymmetric CryptographyAufTime established TLS connections to its C2 using WolfSSL.T1574.002 · DLL Side-LoadingCloudyLoader, LocalPlugx, CloudSorcerer, and OneDriveDoor used legitimate executables to load malicious DLLs.T1620 · Reflective Code LoadingCloudyLoader's second-stage shellcode reflectively loaded a DLL payload into process memory.
People
Threat Actors
APT31Cyberespionage group to which the researchers linked some attacks against Russia's IT sector in 2024–2025; the article describes its malware, persistence, lateral movement, credential theft, and exfiltration.Judgment PandaNamed in the article title, which presents the research as APT31 activity.
Malware
AufTimeThe attacks involved new malware samples, including AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor.CloudSorcererThe attackers used both third-party tools (for lateral movement and reconnaissance) and their own malware, including LocalPlugx, CloudSorcerer, COFFProxy, VtChatter, CloudyLoader, OneDriveDoor, and GrewApacha.CloudyLoaderThe attacks involved new malware samples, including AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor.COFFProxyThe attacks involved new malware samples, including AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor.GrewApachaThe attackers used both third-party tools (for lateral movement and reconnaissance) and their own malware, including LocalPlugx, CloudSorcerer, COFFProxy, VtChatter, CloudyLoader, OneDriveDoor, and GrewApacha.LocalPlugxThe attackers used both third-party tools (for lateral movement and reconnaissance) and their own malware, including LocalPlugx, CloudSorcerer, COFFProxy, VtChatter, CloudyLoader, OneDriveDoor, and GrewApacha.OneDriveDoorThe attacks involved new malware samples, including AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor.OWOWAwe also identified a malicious IIS module designed to steal Outlook on the web users' credentials. The OWOWA module is installed on a web server and monitors HTTP requests and responses on the Outlook sign-in page.PlugXInterestingly, on a system infected with this backdoor, the attackers ran a netsh command for the PlugX listening port, adding a firewall rule to allow an incoming TCP connections on port 5335.VtChatterThe attacks involved new malware samples, including AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor.YaLeakThe attacks involved new malware samples, including AufTime, COFFProxy, VtChatter, YaLeak, CloudyLoader, and OneDriveDoor.
Vendors
Microsoftpowershell -Command Get-WinEvent -LogName 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational' | Where-Object {$_.Id -eq 21} | ForEach-Object { $eventXml = [xml]$_.ToXml(); $username =Positive TechnologiesThis style of gaining persistence is common among Asian threat groups. Positive Technologies' own tool PT Dumper includes a module designed to detect this technique. PT Dumper is a Golang-based utility for collectingYandexcloud-api.yandex.net
Products
EdgeSharpChrome.exe — used to extract credentials and cookies from Chrome and recent versions of Edge.Google ChromeSharpChrome.exe — used to extract credentials and cookies from Chrome and recent versions of Edge.IISDuring the investigation of an incident linked to this group, we also identified a malicious IIS module designed to steal Outlook on the web users' credentials. The OWOWA module is installed on a web server and monitorsLinuxAufTime — a Linux backdoor that uses the WolfSSL library to communicate with its C2.Microsoft OneDriveOneDriveDoor — a backdoor that uses OneDrive cloud storage as its C2.Microsoft Windows"C:\Windows\System32\cmd.exe" /c echo F |Outlook on the webof an incident linked to this group, we also identified a malicious IIS module designed to steal Outlook on the web users' credentials. The OWOWA module is installed on a web server and monitors HTTP requests andThreadRacerThe executable file Seting.exe is a ThreadRacer CPU benchmark component that is vulnerable to DLL sideloading. It loads the dynamic library pl_rsrc_english.dll, which acts as a shellcode loader. The shellcode is storedVirusTotalVtChatter — malware that uses comments to a file on VirusTotal as a bidirectional C2 channel.Windows Sticky NotesStickyNotesExtract.exe — used to extract data from the Windows Sticky Notes database.Yandex DiskFor data exfiltration, the attackers used a small utility written in .NET. The tool uploaded information to Yandex Disk cloud storage, and was therefore named YaLeak.
Tools
Advanced IP ScannerFor network scanning, the attackers used Advanced IP Scanner, which allowed them to quickly identify devices across the environment.Cobalt Strikeas "Requirements.rar") containing an LNK file that launched a lure document and CloudyLoader, a Cobalt Strike loader. This attack is described in more detail in a separate article.CoffloaderCOFFProxy — a backdoor that loads Beacon payloads in Coffloader format. We also identified a Golang implementation of this tool that, instead of loading a Beacon, executes commands similar to those run via cmd.GarbleThe same backdoor, but written in Golang and compiled for Linux. It is additionally obfuscated with Garble and was observed on systems under the name time. This version is functionally similar, but instead of executingImpacketFor lateral movement inside the perimeter, the group used tools from the public Impacket toolkit, including WmiExec and SmbExec, as well as RDP.Microsoft dev tunnelsAPT31 also used Microsoft dev tunnels for traffic tunneling, via the Microsoft-signed file devtunnel.exe. The attackers combined this tool with the LocalPlugx malware, which listened for commands on a specific port.MimikatzThe following command uses the Mimikatz utility to perform a Pass-the-Hash (PTH) attack in combination with RDP Restricted Admin Mode:PT DumperThis style of gaining persistence is common among Asian threat groups. Positive Technologies' own tool PT Dumper includes a module designed to detect this technique. PT Dumper is a Golang-based utility for collectingsecretdump.pyThey then used the public Impacket utility secretdump.py to extract credential data from the registry.SharpADUserIPTo collect information about hosts in the compromised infrastructure, APT31 used SharpADUserIP, a C# tool that extracts usernames and IP addresses from event 4624 in Security.evtx.SharpChrome.exeSharpChrome.exe — used to extract credentials and cookies from Chrome and recent versions of Edge.SharpDir.exeSharpDir.exe — a file search utility.smbexecFor lateral movement inside the perimeter, the group used tools from the public Impacket toolkit, including WmiExec and SmbExec, as well as RDP.StickyNotesExtract.exeStickyNotesExtract.exe — used to extract data from the Windows Sticky Notes database.Tailscale VPNbetween the compromised host and the attacker infrastructure, the attackers used the legitimate tool Tailscale VPN. This allowed them to move data covertly and bypass perimeter defenses.VMProtectThe DLL that implements the core shellcode decryption functionality is protected with VMProtect and uses custom section names. In some cases, these section names matched the name of the compromised organization.wmiexecFor lateral movement inside the perimeter, the group used tools from the public Impacket toolkit, including WmiExec and SmbExec, as well as RDP.
Countries
PeruAPT31 used the same technique outside Russia as well. We found an archive named Seguro_de_lMRE.zip, which appears to have been downloaded in Peru.RussiaFrom 2024 to 2025, Russia's IT sector — particularly contractors and systems integrators serving government agencies — was hit by a series of targeted cyberattacks. What made these attacks stand out was the attackers'