Source: www.govinfosecurity.com – Author:
Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Government
Secret Blizzard Used Third-Party Amadey Bots to Hack Ukrainian Military Devices Jayant Chakravarti (@JayJay_Tech) • December 12, 2024
A Russian state-backed hacker group used third-party data-stealing bots and possibly a backdoor used by another Russia-based threat group to infiltrate and spy on devices used by frontline Ukrainian military units.
See Also: Advancing Cyber Resiliency With Proactive Data Risk Reduction
Microsoft attributed the espionage activity to Center 16 of Russia’s premier intelligence agency, the Federal Security Service, which it tracks as Secret Blizzard. The group, between March and April, used the frequently-used Amadey malware to deploy PowerShell backdoors and its custom KazuarV2 backdoor on target devices.
The espionage hacks consisted of a three-stage surveillance effort to locate and capture information from devices used by Ukrainian troops. In the initial stage, Secret Blizzard used third-party Amadey bots to capture device information, including the device name, administrator status and codes for installed antivirus programs.
In the second stage, Secret Blizzard deployed a custom reconnaissance tool on devices during the initial surveillance effort, particularly Ukrainian front-line military devices associated with Starlink IP addresses.
In the third stage, the group used an executable named “procmap.exe” to deploy the custom Tavdig backdoor payload, which obtained additional information about the device’s network connections, stored information, installed patches and communications with other devices. The group also deployed the KazuarV2 backdoor Trojan to carry out advanced surveillance on victim devices.
Microsoft’s warning follows a similar alert the company issued on Dec. 4 regarding Secret Blizzard, also tracked as Venomous Bear, Snake and Turla APT group, which hijacked the command and control infrastructure of a Pakistan-based espionage network tracked as Storm-0156 to deploy its own backdoors on targeted devices in Asia. The victims included Afghanistan’s Ministry of Foreign Affairs, the General Directorate of Intelligence and the country’s foreign consulates (see: Russian APT Hackers Co-Opt Pakistani Infrastructure).
Secret Blizzard, located in the town of Ryazan outside Moscow, has spent at least 25 years carrying out covert surveillance operations targeting foreign government entities to obtain information of use to the Vladimir Putin regime. The group’s primary targets include ministries of foreign affairs, embassies, government offices, defense departments and defense-related companies worldwide.
During the March-April campaign, Secret Blizzard used the third-party Amadey bots around the same time other threat actors used them to deploy XMRIG cryptocurrency miners onto devices. Microsoft assessed that the espionage group either used the Amadey malware-as-a-service offering or covertly accessed the bot’s command-and-control panels to drop PowerShell droppers on targeted devices.
The group likely used spear-phishing attacks to lure targeted military personnel into downloading the Amadey bots into their devices. According to Microsoft, Secret Blizzard commonly uses spear-phishing as an initial attack vector and then uses server-side and edge device compromises to move laterally within compromised networks.
The custom reconnaissance tool injected by the PowerShell droppers used the RC4 algorithm to decrypt a batch file that collected an assortment of data from victim devices, including the directory tree, active sessions, system information, IPv4 route table, SMB shares, enabled security groups and time settings.
The collected information was again encrypted with RC4 and sent to Secret Blizzard’s command-and-control server. The tool also decrypted the command line “cmdlet” to determine if a victim device had Microsoft Defender enabled or if the program had previously flagged Amadey-related activity.
Microsoft researchers also observed signs of Secret Blizzard activity targeting Ukrainian military devices that were compromised by another Russia-based threat group in January. That group, tracked as Storm-1837, previously targeted devices used by Ukrainian drone operators.
When the Storm-1837 PowerShell backdoor launched, researchers noted that the PowerShell dropper installed on the device featured similar functionality as the dropper used by Secret Blizzard when it used Amadey bots. The dropper contained two base64 encoded files that contained the Tavdig backdoor payload and a Symantec binary.
Original Post URL: https://www.govinfosecurity.com/russia-used-borrowed-spyware-to-target-ukrainian-troops-a-27048
Category & Tags: –
Views: 0
