Background
This is a continuation of our coverage of cyberattacks targeting Ukrainian entities. Earlier this year, we published a blog post describing Armageddon activity targeting Ukraine and details on their infrastructure, as reported by Palo Alto’s Unit 42. Symantec recently reported on yet another wave of Armageddon attacks, leveraging new Pterodo variants to target Ukrainian assets.
What is Pterodo?
Pterodo, also known as Pteranodon, is a backdoor RAT. Armageddon is currently using at least four distinct variants of Pterodo. The four variants analyzed all used Visual Basic Script (VBS) droppers, dropped a VBScripts file, used Scheduled Tasks to ensure persistence, and downloaded code from a C2. Additionally, all four used similar obfuscation methods. Although the variants operate similarly to one another, each communicates with a different C2. Symantec assessed the threat actors likely use multiple variants to help maintain persistence by providing a fallback C2. The variants are referred to as Backdoor.Pterodo.B, Backdoor.Pterodo.C, Backdoor.Pterodo.D, and Backdoor.Pterodo.E.
Backdoor.Pterodo.B is a modified self extracting archive unpacked using 7-Zip. It contains obfuscated VBScripts, which it adds as scheduled tasks to maintain persistence. The script also copies itself to the [USERPROFILE]\ntusers.ini file. It creates two new obfuscated VBScripts. One of the VBSCripts gathers system information and sends it to the C2, while the other copies a previously dropped ntusers.ini file to another desktop.ini file.
Backdoor.Pterodo.C also drops VBScripts on the victim machine but uses API hammering, making multiple meaningless API calls, in an attempt to evade sandbox detection. The malware unpacks a script and the file offspring.gif to C:\Users\[username]\. The variant then calls the script, which in turn runs ipconfig /flushdns and executes the offspring.gif file. Offsprint.gif downloads and executes a PowerShell script from a random subdomain of corolain[.]ru.
Backdoor.Pterodo.D is yet another VBScript dropper. It creates and executes two files. One script runs ipconfig /flushdns then calls the second script and removes the original executable. The second script , which has two layers of obfuscation, downloads and executes the final payload from declined.delivered.maizuko[.]ru.
Backdoor.Pterodo.E operates similarly to variants B and C and uses script obfuscation similar to the other variants. This variant engages in API hammering then extracts two VBScript files to the victim’s home directory.
Who is Armageddon?
Armageddon, also known as Gameredon, Shuckworm, or Primitive Bear, is currently one of the most active APT groups targeting Ukrainian assets. The group’s activity has traditionally involved espionage activity aligned with Russian interests. In November 2021, the Security Service of Ukraine (SSU) publicly linked five Russian Federal Security Service (FSB) officers based in Crimea to the group. A report by the SSU stated Armageddon has been active since at least 2014 and has engaged in multiple cyber-espionage campaigns from 2017-2021. The SSU report notes Armageddon does not typically use sophisticated TTPs and does not seem to emphasize OPSEC. Some of the other tools and TTPs used by Armageddon include spearphishing, PowerShell, UltraVNC, FileStealer, and EvilGnome.
IOCs
PolySwarm has multiple samples associated with Pterodo.
119f9f69e6fa1f02c1940d1d222ecf67d739c7d240b5ac8d7ec862998fee064d
Background
CERT-UA recently released an advisory on IcedID, a modular banking trojan being dropped via a social engineering campaign targeting Ukrainian government entities, and related Zimbra exploits.
Background
ESET recently reported on Industroyer2, a multi-component ICS malware used to target a Ukrainian energy company.
Background
Since January, Ukraine has been targeted by several wiper malware families. In early February, we reported on the WhisperGate wiper. Earlier this month we spotlighted HermeticWiper and IsaacWiper. Ukraine was recently under attack by yet another wiper malware. ESET announced the discovery of CaddyWiper on March 14th in a tweet. Cisco Talos followed up a day later with more information on this malware.
Background
CERT-UA, the Ukraine government’s incident response team, recently released a report on MicroBackdoor. CERT-UA did not provide further information on the scope of the incident leading to the discovery of this malware.
Background
Ukraine was recently targeted by several wiper malware families. In January, WhisperGate, which was attributed to a Belarusian threat actor group known as Ghostwriter/UNC1151, targeted Ukraine’s government, non-profit, and technology verticals. On February 23, another wiper malware dubbed HermeticWiper or FoxBlade was used to target Ukraine. On February 24, a third wiper malware was observed targeting Ukrainian entities. This new malware was dubbed IsaacWiper. ESET recently published research on HermeticWiper and IsaacWiper.
PolySwarm Threat Bulletin
THIS THREAT BULLETIN IS PROVIDED FOR SITUATIONAL AWARENESS
Background
This report is part of our ongoing coverage of the Russia-Ukraine conflict and cyber implications.
PolySwarm recently released the following publications and blog posts discussing Russia-Ukraine tensions and the potential for both kinetic and cyber conflict:
PolySwarm Threat Bulletin
THIS THREAT BULLETIN IS PROVIDED FOR SITUATIONAL AWARENESS
Background
PolySwarm recently released several publications and blog posts discussing Russia-Ukraine tensions and the potential for both kinetic and cyber conflict: