Talos Details Malware Campaigns Targeting Ukraine and Poland
Summary
Cisco Talos analyzed campaigns targeting government, military, business, and civilian users in Ukraine and Poland. Malicious Office files launch downloaders that extract payloads hidden in images, including AgentTesla, Cobalt Strike, and njRAT.
Key points
- Campaign activity dates back to April 2022 and continued into July 2023, targeting organizations and users in Ukraine and Poland.
- CERT-UA attributed the July 2023 campaign to UNC1151, within GhostWriter operations allegedly linked to the Belarusian government.
- Lures use malicious Excel or PowerPoint files to persuade recipients to enable macros, which begin the infection chain.
- VBA code drops an executable or DLL and creates a shortcut that uses regsvr32.exe or rundll32.exe to launch the next stage.
- Downloaders retrieve image files with encrypted malware appended, then decrypt and load the payload; techniques include AES/Rijndael and, in one variant, simplified RC4.
- Reported final payloads include AgentTesla, Cobalt Strike beacons, and njRAT, associated with information theft and remote access.
- Talos lists detection options and ClamAV signatures; related indicators of compromise are available from the source.
Article Details
- Attack Vectors
- Malicious Excel and PowerPoint documents, possibly sent as email attachments, used socially engineered lures to persuade targets to enable VBA macros.
- Obfuscated VBA decoded and dropped a downloader executable or DLL, then created and launched a shortcut invoking regsvr32.exe or rundll32.exe.
- Downloaders retrieved image files with encrypted payloads appended; payloads were decrypted and, in some variants, reflectively loaded.
- Defensive Notes
- Talos recommends using email and endpoint protections to block malicious messages and malware execution, and network protections to detect or block associated activity.
- Cisco Talos lists applicable ClamAV signatures, including Doc.Malware.Corona-10003975-0, Win.Downloader.DotNETEncryptedJPEG-10006210-0 through Win.Downloader.DotNETEncryptedJPEG-10006222-0, Img.Dropper.Agent-10006223-0, Img.Dropper.Agent-10006224-0, Xls.Dropper.Corona-10006204-0, Xls.Dropper.Corona-10006205-1, Xls.Dropper.Corona-10006207-0, Xls.Dropper.Corona-10006207-1, Ole2.Dropper.Corona-10006206-1, Ole2.Dropper.Corona-10006209-0, and Win.Trojan.Generic-6417450-0.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe VBA code and downloader functions were obfuscated; encoded payload data was split across strings.T1059.005 · Visual BasicVBA macros in Excel and PowerPoint documents initiated the infection process and dropped or launched subsequent stages.T1105 · Ingress Tool TransferDownloaders retrieved image files containing appended encrypted payloads from URLs.T1204.002 · Malicious FileTargets were lured into opening malicious Office documents and enabling macros to start the infection chain.T1218.010 · Regsvr32The infection chain used regsvr32.exe to launch a DLL stage and, in the July 2023 campaign, to call DllUnregisterServer.T1218.011 · Rundll32The infection chain used rundll32.exe to launch DLL exports, including a function that downloaded the next stage.T1620 · Reflective Code LoadingA downloader reflectively loaded decrypted payload bytes using Assembly.Load.
Threat Actors
Malware
AgentTeslaThe final payloads include the AgentTesla remote access trojan (RAT), Cobalt Strike beacons and njRAT.njRATThe final payloads include the AgentTesla remote access trojan (RAT), Cobalt Strike beacons and njRAT.PicassoLoaderwhich makes the unpacking more difficult for malware researchers. CERT-UA named the downloader PicassoLoader.
Products
Microsoft Excelmultistage infection chain initiated with malicious Microsoft Office documents, most commonly using Microsoft Excel and PowerPoint file formats. This was followed by an executable downloader and payload concealed inMicrosoft OfficeThe attacks used a multistage infection chain initiated with malicious Microsoft Office documents, most commonly using Microsoft Excel and PowerPoint file formats. This was followed by an executable downloader andMicrosoft PowerPoint
Tools
Cobalt StrikeThe final payloads include the AgentTesla remote access trojan (RAT), Cobalt Strike beacons and njRAT.ConfuserExThe next stage is a Portable Executable (PE) file, an executable or a DLL file. ConfuserEx obfuscator, an obfuscator that is very commonly used by malicious actors to obfuscate .NET code, is used with various levels of