AgingFly Malware Targets Ukrainian Governments and Hospitals to Steal Credentials
Summary
CERT-UA links the UAC-0247 cluster to Ukraine-focused attacks using AgingFly against local governments and hospitals. The C# malware targets browser and WhatsApp data through a phishing-led LNK-to-HTA chain and dynamically compiles C2-delivered handlers.
Key points
- CERT-UA attributes the campaign to UAC-0247; investigators examined a dozen incidents affecting local governments and hospitals. Defense Forces personnel may also have been targeted.
- Phishing emails purporting to offer humanitarian aid link to compromised or fake websites, leading to an archive containing an LNK file that launches an HTA.
- The HTA creates a scheduled task to download and run a payload that injects shellcode into a legitimate process; the chain also uses staged loaders.
- Operators use ChromElevator to extract Chromium browser cookies and saved passwords, and ZAPiDESK to decrypt Windows WhatsApp databases.
- AgingFly is C# malware with remote-control, command-execution, file-exfiltration, screenshot, keylogging, and arbitrary-code-execution capabilities.
- AgingFly retrieves command-handler source code from its C2 server and compiles it on the infected host; it communicates over WebSockets with AES-CBC encryption.
- CERT-UA recommends blocking LNK, HTA, and JS file launches to disrupt the campaign’s attack chain.
Article Details
- Attack Vectors
- A humanitarian-aid-themed phishing email prompts recipients to click an embedded link, which redirects to a compromised legitimate site or an AI-generated fake site.
- The attack delivers an LNK shortcut that launches an HTA; the HTA creates a scheduled task to download and run an EXE payload that injects shellcode into a legitimate process.
- AgingFly steals authentication data from Chromium-based browsers and the WhatsApp Windows client, using ChromElevator and ZAPiDESK to extract browser data and decrypt WhatsApp databases.
- Operators use RustScan, Ligolo-ng, and Chisel for reconnaissance and tunneling; CERT-UA reports attempts at lateral movement.
- AgingFly communicates with its C2 over WebSockets using AES-CBC encryption and retrieves source code from the C2 to compile command handlers at runtime.
- Defensive Notes
- CERT-UA recommends blocking the launch of LNK, HTA, and JS files to disrupt the campaign's attack chain.
MITRE ATT&CK
T1046 · Network Service DiscoveryRustScan is used for port scanning during reconnaissance.T1053.005 · Scheduled TaskThe HTA creates a scheduled task that downloads and runs an EXE payload.T1055 · Process InjectionThe downloaded EXE payload injects shellcode into a legitimate process.T1056.001 · KeyloggingAgingFly provides operators with keylogging capability.T1059.001 · PowerShellThe SILENTLOOP PowerShell script is used to execute commands and update configuration.T1059.003 · Windows Command ShellAgingFly executes commands through the Windows Command Prompt.T1071.001 · Web ProtocolsAgingFly communicates with its C2 server over WebSockets.T1105 · Ingress Tool TransferThe attack chain retrieves HTA and EXE payloads from remote resources.T1113 · Screen CaptureAgingFly provides operators with screenshot-capture capability.T1204.001 · Malicious LinkThe recipient is encouraged to click the phishing link embedded in the email.T1204.002 · Malicious FileThe attack chain uses an LNK shortcut file that the target launches.T1218.005 · MshtaThe LNK launches a built-in HTA handler, which retrieves and executes an HTA file.T1555.003 · Credentials from Web BrowsersChromElevator is used to extract cookies and saved passwords from Chromium-based browsers.T1566.002 · Spearphishing LinkA humanitarian-aid-themed email contains a link that leads to the attack's delivery chain.T1573.001 · Symmetric CryptographyAgingFly encrypts C2 traffic using AES-CBC; the article also describes an XOR-encrypted TCP connection in the attack chain.
Threat Actors
Malware
Products
Braveinformation, like cookies and saved passwords, from Chromium-based browsers (e.g., Google Chrome, Edge, Brave) without needing administrator privileges.Edgeinformation, like cookies and saved passwords, from Chromium-based browsers (e.g., Google Chrome, Edge, Brave) without needing administrator privileges.Google Chromeextract sensitive information, like cookies and saved passwords, from Chromium-based browsers (e.g., Google Chrome, Edge, Brave) without needing administrator privileges.Microsoft WindowsA new C# malware family called AgingFly has been used in Ukraine against local governments and hospitals to steal authentication data from Chromium-based browsers and the WhatsApp Windows client.WhatsAppA new C# malware family called AgingFly has been used in Ukraine against local governments and hospitals to steal authentication data from Chromium-based browsers and the WhatsApp Windows client.
Tools
Chiselon the network, and uses publicly available utilities, like the RustScan port scanner, the Ligolo-ng and Chisel tunneling tools.ChromElevatora complex LNKâHTAâscheduled-task attack chain that stages payloads, uses open-source tools like ChromElevator and ZAPiDESK to exfiltrate credentials, and dynamically compiles command handlers received from a C2Ligolo-nglaterally on the network, and uses publicly available utilities, like the RustScan port scanner, the Ligolo-ng and Chisel tunneling tools.rustscanactivity and tries to move laterally on the network, and uses publicly available utilities, like the RustScan port scanner, the Ligolo-ng and Chisel tunneling tools.SILENTLOOPAt the same time, a PowerShell script (SILENTLOOP) is used to execute commands, update the configuration, and retrieve the C2 server address from a Telegram channel or fallback mechanisms.ZAPiDESKattack chain that stages payloads, uses open-source tools like ChromElevator and ZAPiDESK to exfiltrate credentials, and dynamically compiles command handlers received from a C2 server.