Kaspersky’s ICS CERT has revealed the concluding segment of its research series, devoted to attacks on industrial organizations in Eastern Europe. This latest announcement investigates third-stage malware, designed for the uploading of files to Dropbox and to also coordinate with other malware implants to exfiltrate data.
This third-stage data exfiltration activity involves itself a three-step malware execution chain. Firstly, this execution chain establishes persistence and orchestrates the deployment and initiation of the second-step malware module. This module is responsible for uploading collected files to a remote server with the help of the third-step module. The intricate architecture allows the threat actor to recalibrate the execution flow by replacing individual modules within the chain. In some cases, the chain could be used for data exfiltration from network segments isolated from internet by setting up an intermediate/proxy storage for the stolen data inside the victims’ network.
In the evolving landscape of this cyberattack campaign, the threat actor deployed a malware chain to access Outlook mailbox files, execute remote commands, and perform the uploading of local or remote “.rar” files to Dropbox.
Additionally, our investigation highlights the use of tools for manual data transfer. One tool is specifically designed for moving files to and from Yandex Disk, while another allows for easy file uploads to 16 temporary file sharing services. The third one, being downloaded from Yandex Disk, had the functionality to send the implant chain execution log data to Yandex mail accounts.
These insights provide a glimpse into the threat actor’s intricate data exfiltration techniques.
“Our comprehensive analysis underscores the adaptability of threat actors in their pursuit of sensitive data. By unraveling the mechanics of these advanced implants, we provide the cybersecurity community with crucial knowledge to fortify defenses against increasingly sophisticated attacks,” comments Kirill Kruglov, Senior Security Researcher at Kaspersky ICS CERT.
