Hacker Group Uses RATVERMIN Backdoor to Target Ukrainian Military

guest · Apr 16, 2019

Hacker Group Uses RATVERMIN Backdoor to Target Ukrainian Military
April 16, 2019
https://www.bleepingcomputer.com/ne...vermin-backdoor-to-target-ukrainian-military/

Multiple Ukrainian military departments were targeted by a spear phishing campaign which attempted to drop a RATVERMIN backdoor as part of a second-stage payload delivered with the help of a Powershell script.
RATVERMIN dropped using Powershell script
As unearthed by FireEye Threat Intelligence after analyzing compile times for malware used during their attacks, the group appears to have been active since at least 2014 with their attacks being "primarily focused on targeting Ukrainian entities."

In addition, "The 2018 campaign used standalone EXE or self-extracting RAR (SFX) files to infect victims. However, their recent activity showed increased sophistication by leveraging malicious LNK files," said the researchers. "The group used open-source QUASARRAT and the RATVERMIN malware, which we have not seen used by any other groups."

The other two documents originating from the official Armtrac website [1, 2] designed to further gain the trust of the potential victims were packed in a ZIP archive, compressed again as a 7z archive named Armtrac-Commercial.7z, and attached to the phishing emails.
Click to expand...

FireEye: Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People's Republic

Log in or Sign up

Hacker Group Uses RATVERMIN Backdoor to Target Ukrainian Military

guest Guest

Log in or Sign up

Hacker Group Uses RATVERMIN Backdoor to Target Ukrainian Military

guest Guest

Useful Searches