Operation Silent Rotor Uses Rust Malware to Target Eurasian Aviation Sector
Summary
SEQRITE Labs describes a spear-phishing campaign targeting Eurasian aviation professionals with Russian-language lures. Its Rust malware profiles systems, sends data to cdn[.]kleymarket[.]ru, and downloads a second-stage payload; no actor attribution is established.
Key points
- The campaign uses Russian-language aviation-themed lures timed around the Unmanned Aviation 2026 forum in Moscow.
- A ZIP archive contains a Rust-based Windows executable alongside business-themed PDF, DOCX, and XLSX decoys.
- The executable displays an embedded decoy document, then collects hostname, volume serial number, user and domain details, and network information.
- Collected data is serialized as JSON, XOR-encrypted, and sent by HTTPS POST to cdn[.]kleymarket[.]ru.
- The malware decrypts a server response using AES-256, drops a randomly named executable in a user document directory, and launches it.
- SEQRITE Labs reports that kleymarket[.]ru was recently registered and resolved to 45.142.36.76; the researchers do not attribute the campaign to a known actor.
Article Details
- Attack Vectors
- Spear-phishing emails deliver a ZIP archive containing a disguised Rust-based Windows executable and aviation-themed decoy documents.
- The executable displays an embedded decoy document, collects system and network information, and sends it to attacker infrastructure over HTTPS.
- The malware downloads, decrypts, writes, and executes a second-stage payload.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cdn[.]kleymarket[.]ru | C2 subdomain used to receive exfiltrated victim data and deliver the second-stage payload. |
| DOMAIN | kleymarket[.]ru | Recently registered domain identified in the campaign's C2 infrastructure. |
| IPV4 | 45[.]142[.]36[.]76 | IP address identified as the active C2 server for the campaign. |
| SHA256 | 2064ef387ac9e51ba72b32004d99e8a0b291dbab24ed8db30f437abf1b40cb49 | SHA-256 hash of the DOCX decoy associated with the malicious executable. |
| SHA256 | 57e26f6e3b311a1064c946b69159ee05abedf9228b2f95c65536429e7ac7fb24 | SHA-256 hash of the cai partner.zip archive carrying the malicious executable and decoy documents. |
| SHA256 | 5936f42ffd7fa7896eeae725b60a5d26bbf3e584712671ef5da0138ee5d58f60 | SHA-256 hash of the malicious Rust-based executable. |
| SHA256 | 89f8e42c825d09a0a50e99bbf7304d7037be33ea362a57d34f87fa7981f80126 | SHA-256 hash of the summary_order_cai_final.xlsx decoy included in the malicious archive. |
| SHA256 | a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202 | SHA-256 hash of the Certificate of translation.PDF decoy included in the malicious archive. |
| SHA256 | fdef9e489f773319f55f92f712d1b7b5447d59a632b8f4173d1b161d3759ad92 | SHA-256 hash of the suspicious cai partner (1).zip archive associated with the campaign. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe malware enumerates network adapters and retrieves their IPv4 addresses and DNS-related information.T1027 · Obfuscated Files or InformationThe malware XOR-encrypts victim data and receives an encrypted second-stage payload.T1033 · System Owner/User DiscoveryThe malware collects environment variables including USER and USERDNSDOMAIN.T1036.004 · Masquerade Task or ServiceThe executable is disguised as a CAI order-confirmation document, and the archive includes business-themed decoy files.T1041 · Exfiltration Over C2 ChannelVictim information is sent to the C2 server as XOR-encrypted JSON over the C2 channel.T1071.001 · Web ProtocolsThe malware communicates with its C2 infrastructure over HTTPS.T1082 · System Information DiscoveryThe malware collects the hostname and C: drive volume serial number to identify the victim system.T1105 · Ingress Tool TransferThe malware downloads a second-stage payload from the C2 server, writes it to disk, and executes it.T1106 · Native APIThe malware uses Windows APIs including GetComputerNameExW, GetVolumeInformationW, NtWriteFile, and CreateProcessA.T1140 · Deobfuscate/Decode Files or InformationThe malware decrypts the server response, including using AES-256 to decrypt the second-stage payload.T1204.002 · Malicious FileThe victim must open the archive and run the disguised executable to trigger the infection.T1566.001 · Spearphishing AttachmentSpear-phishing attachments deliver the ZIP archive containing the lure files and executable.
Products
Tools
ValidinFurther analysis using Validin confirms that the domain and its associated subdomain resolve to the IP address 45[.]142[.]36[.]76, which appears to be the active C2 infrastructure used in this campaign.VirusTotalAs we were investigating recent ongoing campaigns, we identified a suspicious ZIP file named cai partner (1).zip on the public sandbox, VirusTotal.
Countries
RussiaThe campaign targets professionals and organizations in the Eurasian unmanned aviation sector, with geographic interest spanning Russia, Tajikistan, Central Asia, the Middle East, and Europe.TajikistanThe campaign targets professionals and organizations in the Eurasian unmanned aviation sector, with geographic interest spanning Russia, Tajikistan, Central Asia, the Middle East, and Europe.