March 20, 2023

Feb 08, 2023Ravie LakshmananMenace Intelligence / Information Security

information-stealing malware

A Russia-linked risk actor has been noticed deploying a brand new information-stealing malware in cyber assaults concentrating on Ukraine.

Dubbed Graphiron by Broadcom-owned Symantec, the malware is the handiwork of an espionage group generally known as Nodaria, which is tracked by the Laptop Emergency Response Workforce of Ukraine (CERT-UA) as UAC-0056.

“The malware is written in Go and is designed to reap a variety of knowledge from the contaminated laptop, together with system info, credentials, screenshots, and information,” the Symantec Menace Hunter Workforce said in a report shared with The Hacker Information.

Nodaria was first spotlighted by CERT-UA in January 2022, calling consideration to the adversary’s use of SaintBot and OutSteel malware in spear-phishing assaults concentrating on authorities entities.

The group, which is claimed to be lively since at the least April 2021, has since repeatedly deployed customized backdoors equivalent to GraphSteel and GrimPlant in varied campaigns since Russia’s army invasion of Ukraine. Choose intrusions have additionally entailed the supply of Cobalt Strike Beacon for post-exploitation.

Graphiron, the newest program added to the group’s arsenal, is an improved model of GraphSteel, packing in options to run shell instructions and harvest system info, information, credentials, screenshots, and SSH keys.

One other notable side is that whereas GraphSteel and GrimPlant made use of Go model 1.16, Graphiron depends on model 1.18, which officially shipped in March 2022. This additionally means that Graphiron is a more moderen growth.

Moreover, an evaluation of the an infection chains reveals the presence of two levels, a downloader that is accountable for retrieving an encrypted payload containing the Graphiron malware from a distant server.

With the newest findings, Nodaria joins one other Russian state-sponsored group known as Gamaredon in extensively singling out Ukraine.

“Whereas Nodaria was comparatively unknown previous to the Russian invasion of Ukraine, the group’s high-level exercise over the previous yr means that it’s now one of many key gamers in Russia’s ongoing cyber campaigns in opposition to Ukraine,” Symantec stated.

Discovered this text attention-grabbing? Observe us on Twitter and LinkedIn to learn extra unique content material we publish.