Ukrainian military organizations have fallen victim to a phishing campaign, with cyber attackers using drone manuals as bait to deliver a Go-based open-source post-exploitation toolkit known as Merlin.
Details about the campaign
Because drones or Unmanned Aerial Vehicles (UAVs) have become crucial tools for the Ukrainian military, there has been a surge in malware-laden lure files disguised as UAV service manuals, according to a report by Securonix researchers.
Image Description: Sample of malicious email
The cybersecurity company is monitoring this cyber threat under the code STARK#VORTEX.
Attack Vectors
- The attack begins with a Microsoft Compiled HTML Help (CHM) file. When this file is opened, it triggers malicious JavaScript code embedded within one of the HTML pages.
- This JavaScript code executes PowerShell commands designed to connect with a remote server, from which it retrieves an obfuscated binary.
- Once decoded, this Windows-based payload extracts the Merlin Agent. This agent is configured to communicate with a command-and-control (C2) server, enabling the attackers to take control of the compromised host.
“While the attack chain appears straightforward, the attackers have employed rather sophisticated Tactics, Techniques, and Procedures (TTPs) and obfuscation methods to evade detection,” noted the researchers.
Has it happened before?
This is the first time Ukrainian government entities have been targeted using the Merlin toolkit.
In early August 2023, the Computer Emergency Response Team of Ukraine (CERT-UA) disclosed a similar attack chain that employed CHM files as decoys to infect computers with this open-source tool.
The CERT-UA attributed these intrusions to a threat actor they track under the name UAC-0154.
The researchers clarified,
“The files and documents in this attack chain are highly effective at evading defenses. Normally, receiving a Microsoft help file online would be considered unusual.”
However, the attackers crafted the lure documents to resemble something an unsuspecting victim might expect to encounter in a help-related document or file.
Ukraine War: Not only humanity but cyber sustenance at risk
Using drone manuals as bait sounds like something cunning exploiting the military reliance on UAVs. The threat actors have become crafty with malicious codes in Javascript and Powershell commands.
In a hostile environment, defending from cyber attacks is challenging for the nation. Let’s stand against War and Cyber War together!
PureVPN
October 2, 2023
2 years ago
