Recent developments in cybersecurity include COLDRIVER custom malware. Infamous hacker group COLDRIVER has taken attack tactics to a new level and introduced custom his malware. “Proton-decrypter.exe” This nomenclature choice is important because Microsoft previously revealed that attackers were primarily leveraging Proton Drive to send PDF lures through phishing messages. In this blog post: COLDRIVER custom malwaredelves into evolving attack tactics and reveals important insights into the cybersecurity landscape.
proton drive deception
Google Threat Analysis Group (TAG) researchers revealed We reported to The Hacker News that the PDF documents used in the attack were hosted on Proton Drive. Interestingly, the attacker claims that this tool is meant to decrypt files hosted on this cloud platform. But the reality is far more sinister. The so-called decryptor is actually a backdoor he named SPICA. of High-profile targets of COLDRIVER attacks It grants threat actors covert access to targeted machines while displaying decoy documents to mislead and retain users.
From Scout to SPICA
Previous research from WithSecure (formerly F-Secure) revealed COLDRIVER's use of a lightweight backdoor called Scout. This malware tool originates from the HackingTeam Remote Control System (RCS) Galileo hacking platform and was observed in the following locations: spear phishing campaign Scout acts as an initial reconnaissance tool, gathering basic system information and screenshots, allowing for the installation of additional malware.
The latest development SPICA is COLDRIVER's first custom malware. Use JSON over WebSocket. Command and Control (C2), can execute arbitrary shell commands, steal cookies from web browsers, upload and download files, and enumerate and extract files. Persistence is maintained through the use of scheduled tasks.
SPICA malware by COLDRIVER
When executed, SPICA decodes the embedded PDF, writes it to disk, and opens it as a decoy for the user. At the same time, it establishes persistence in the background and starts the main C2 loop to wait for command execution.of Sophisticated Spica malware Its versatility allows hackers to perform various malicious activities on the compromised system.
Extensive campaign timeline
Evidence shows COLDRIVER's use of SPICA dates back to November 2022. The Cybersecurity Department has identified multiple variants of SPICA. “encrypted” PDF Lure. Demonstrates the existence of different SPICA versions tailored to match lure documents sent to specific targets.these Sectors targeted by COLDRIVER attacks We propose a strategic and evolving approach by nation-state actors.
Limited targeted attacks
Although Google TAG does not know the exact number of victims that have been successfully compromised by SPICA, we believe that SPICA may have been deployed. “A very limited and targeted attack.” The focus appears to be on non-governmental organizations (NGOs), former intelligence and military officials, and prominent figures in the defense sector and NATO governments. The precision of this targeting implies a concerted effort by COLDRIVER to pursue its strategic goals.
COLDRIVER Custom Malware – International Response
The revelations prompted both the UK and US governments to impose sanctions on Russian members of Cold River, Ruslan Aleksandrovich Perechatko and Andrei Stanislavovich Korinets, for their involvement in spear-phishing operations. The announcement was made one month after the imposition. French cybersecurity company Sekoia further exposed links between Korinets and a known infrastructure consisting of numerous phishing domains and multiple servers used by this group.
Unmask Callisto
Sequoia suggests that Andrei Stanislavovich Korinets, a key member of COLDRIVER, has expertise in domain registration. This skill may be utilized by Russian intelligence services directly or through relationships with contractors. This results in Evolution of the COLDRIVER hacker group Activities supporting Moscow's strategic interests, revealed by Mr. Sequoia “Callisto” One of the tools used by COLDRIVER to contribute to Russian intelligence operations.
countermeasure
In response to ongoing threats, Google TAG: COLDRIVER custom malware motion. They added all known websites, domains, and files associated with the hacking group to the Safe Browsing blocklist. While the exact impact on the number of compromised victims is still unknown, these efforts are intended to prevent further exploitation by COLDRIVER.
Web applications often depend on server side script Process and manage data to enhance the functionality and interactivity of the user experience. However, it is essential to implement strong security measures in your server-side scripts to protect against potential vulnerabilities and ensure a safe online environment for your users.
conclusion
COLDRIVER's evolving tactics are sustained cyber security countermeasure. The deployment of SPICA, a custom backdoor, demonstrates the level of sophistication that enables a wide range of malicious activities. As international cooperation increases to counter these threats, the cybersecurity community remains vigilant in its efforts to protect high-profile individuals and organizations from the ever-evolving cyberattack landscape.
Sources for this article include the following articles hacker news and tech crunch.
The article COLDRIVER Custom Malware: Hackers Evolve Attack Tactics appeared first on TuxCare.
*** This is a TuxCare Security Bloggers Network syndicated blog written by Wajahat Raja. Read the original post: https://tuxcare.com/blog/coldriver-custom-malware-hackers-evolve-attachs-tactics/
