Ukraine detects new Pterodo backdoor malware, warns of Russian cyberattack

guest · Nov 20, 2018

Ukraine detects new Pterodo backdoor malware, warns of Russian cyberattack
Revived Gamaredon threat group just part of wave of new attacks tied to Russia's FSB
November 20, 2018
https://arstechnica.com/information...ackdoor-malware-warns-of-russian-cyberattack/

The Computer Emergency Response Team of Ukraine (CERT-UA) and the Foreign Intelligence Service of Ukraine have detected a new strain of the Pterodo Windows backdoor targeting computers at Ukrainian government agencies, leading officials in Kiev to warn of a pending large-scale cyber attack.

In an alert posted to the organization's website, a CERT-UA official wrote:

CERT-UA together with the Foreign Intelligence Service of Ukraine found new modifications of Pterodo-type malware on computers of state authorities of Ukraine, which is likely to be the preparatory stage for a cyber attack. [...]
Pterodo, also known as Pteradon, is associated with the Gamaredon threat group, a group of attacks based largely on off-the-shelf software that have focused on Ukrainian military and government targets.

According to the CERT-UA bulletin, the new version of Pterodo generates a unique URL for command and control based on the serial number of the hard drive of the infected system. Data about the infected system is uploaded to that URL, [...]
Click to expand...

itman · Nov 20, 2018

Per CERT-UA:

Version: NEW - SAR _ v .14

The main difference between modifications from previous versions is the possibility of infecting the system through flash drives and other removable media, as well as infecting flash drives that connect to the affected machine for further distribution. Documents (.doc, .docx), images (.jpg) and text files (.txt) are copied to a hidden MacOS folder named FILE <arbitrary>. <Extensions> (for example, FILE3462.docx), and the flash drives are created shortcuts with original filenames that ensure the simultaneous opening of the original file copied to the MacOS folder and execution of the created malicious file usb.ini.
Click to expand...

Appears Ukraine after all that has happened to them in the past still haven't locked down USB ports on their gov. computers.

guest · Apr 25, 2019

The Russian Shadow in Eastern Europe: Ukrainian MOD Campaign
April 24, 2019
https://blog.yoroi.company/research/the-russian-shadow-in-eastern-europe-ukrainian-mod-campaign/

This campaign, instead, seems to be linked to another Russian hacking group: Gamaredon.

The origin of the infection is an executable file pretending to be an RTF document.
Actually, the file is a Self Extracting Archive (SFX) claiming to be part of some Oracle software with an invalid signature. Its expiration date has been set up the 16th of March 2019.

The actual malicious logic of the Pteranodon implant is contained within the “30347.cmd” script. Besides junk instructions and obfuscation, the malware gather information about the compromised machine through the command “systeminfo.exe”. The results are stored into the file “fnQWAZC” and then sent to the command and control server “librework[.ddns[.net”, leveraging the wget utility previously found.
Conclusion
The Pteranodon implant seems to be constantly maintained by the Gamaredon APT group since 2013, a tool the attackers found very effective since they are still using it after such a long time.
Click to expand...

guest · Jun 4, 2019

A month later Gamaredon is still active in Eastern Europe
June 4, 2019
https://securityaffairs.co/wordpress/86561/apt/gamaredon-eastern-europe-attacks.html

The Gamaredon attacks against Ukraine don’t seem to have stopped. After a month since our last report we spotted a new suspicious email potentially linked to the Gamaredon group.
The infection chain is composed by different stages of password protected SFX (self extracting archive), each containing vbs or batch scripts. [...] The file has a very low detection rate on VirusTotal platform: only four AV engines are able to identify it
Conclusion
This recent attack campaign shows the Gamaredon operation are still ongoing and confirms the potential Russian interest about infiltrating the East European ecosystem, especially the Ukranian one. The techniques and the infection patterns the Group is using is extremely similar to the other attacks spotted in the past months of 2019, showing the Matryoshka structure to chain SFX archives, typical of their implant, but still effective and not easily detectable by several antivirus engines.

Also, digging into this infection chain, we noticed the come back of third party RATs as payload, a Gamaredon old habit that the usage of the custom-made Pterodo backdoor replaced few times ago.
Click to expand...

Log in or Sign up

Ukraine detects new Pterodo backdoor malware, warns of Russian cyberattack

guest Guest

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

Ukraine detects new Pterodo backdoor malware, warns of Russian cyberattack

guest Guest

itman Registered Member

guest Guest

guest Guest

Useful Searches