Ukrainian Systems Hit by Cobalt Strike Via a Malicious Excel File

A risk actor is making an attempt to deploy the Cobalt Strike post-exploit toolkit on Home windows techniques belonging to customers in Ukraine.

The main focus of the marketing campaign seems to be to realize full distant management of focused techniques for future payload deployment and probably different malicious functions, researchers at Fortinet stated in a weblog publish this week.

Ukraine-Themed Doc

The safety vendor described the risk actor as utilizing a Ukrainian-themed Excel file with an embedded Visible Fundamental utility (VBA) macro as an preliminary lure. If an unwary consumer allows the macro, it deploys a dynamic hyperlink library (DLL) downloader — obfuscated by way of the ConfuserEX open supply device — on the sufferer system.

One of many first issues the DLL downloader does is search for the presence of antivirus and different malware detection instruments on the compromised system. If the downloader detects the presence of 1, it instantly terminates additional exercise. In any other case, it makes use of a Internet request to tug the subsequent stage payload from a distant location. The DLL downloader is designed so it will possibly solely obtain the second stage payload on units positioned particularly in Ukraine. From there, the downloader then executes a collection of steps that ends in Cobalt Strike getting deployed on the sufferer system.

“On this refined assault, the assailant employs multi-stage malware ways to thwart detection whereas making certain operational stability,” Fortinet safety researcher Cara Lin wrote within the weblog. “By implementing location-based checks throughout payload downloads, the attacker goals to masks suspicious exercise, probably eluding scrutiny by analysts,” Lin added.

Different evasion and persistence mechanisms embody the usage of encoded strings within the VBA macro to facilitate the deployment of DLL information, a self-deleting function to evade detection mechanisms and a DLL injector that employs delaying ways, and dad or mum course of termination mechanisms to evade sandboxes.

“These orchestrated maneuvers converge in the direction of the deployment of Cobalt Strike onto focused endpoints, notably throughout the confines of Ukraine’s geopolitical panorama,” Lin stated.

A Sample of Concentrating on

The brand new marketing campaign is much like quite a few others which have focused people and organizations in Ukraine that Fortinet and others have reported in recent times, particularly after Russia’s 2022 invasion. Many of those assaults have concerned makes an attempt to disrupt and degrade the capabilities of Ukraine’s essential infrastructure. Others have focused Ukraine’s authorities and navy entities usually in assist of Russian navy aims within the nation.

Cybergroups based mostly in Russia and people working for its navy intelligence have usually been the first perpetrators. Their weapons of selection have included every part from noisy knowledge wipers and ransomware to extremely refined custom-designed instruments such “Industroyer” that Russia’s Sandworm group utilized in assaults towards Ukraine’s electrical grid.

The brand new assaults that Fortinet detected just lately will not be the primary involving the usage of Cobalt Strike towards Ukrainian targets both. In 2022, the safety vendor noticed one other risk actor utilizing a Ukrainian military-themed Excel doc to ship Cobalt Strike on techniques in Ukraine. Final 12 months, Ukraine’s Laptop Emergency Response Staff reported on risk actor UAC-0057 utilizing an XLS file with an embedded macro and a lure picture to deploy Cobalt Strike Beacon and PicassoLoader malware on sufferer techniques in Ukraine.