Russian Turla Hackers Hijack Decade-Old Malware Infrastructure to Deploy New Backdoors

Jan 08, 2023Ravie LakshmananCyberespionage / Threat Analysis

The Russian cyberespionage group known as Turla has been
observed piggybacking on attack infrastructure used by a decade-old
malware to deliver its own reconnaissance and backdoor tools to
targets in Ukraine.

Google-owned Mandiant, which is tracking the operation under the
uncategorized cluster moniker UNC4210, said the
hijacked servers correspond to a variant of a commodity malware
called ANDROMEDA^[1]
(aka Gamarue) that was uploaded to VirusTotal in 2013.

“UNC4210 re-registered at least three expired ANDROMEDA
command-and-control (C2) domains and began profiling victims to
selectively deploy KOPILUWAK and QUIETCANARY in September 2022,”
Mandiant researchers said^[2]
in an analysis published last week.

Turla, also known by the names Iron Hunter, Krypton, Uroburos,
Venomous Bear, and Waterbug, is an elite nation-state outfit that
primarily targets government, diplomatic, and military
organizations using a large set of custom malware.

Since the onset of Russia’s military invasion^[3]
of Ukraine in February 2022, the adversarial collective has been
linked to a string of credential phishing^[4]
and reconnaissance efforts^[5]
aimed at entities located in the country.

In July 2022, Google’s Threat Analysis Group (TAG) revealed^[6]
that Turla created a malicious Android app to supposedly “help”
pro-Ukrainian hacktivists launch distributed denial-of-service
(DDoS) attacks against Russian sites.

The latest discovery from Mandiant shows that Turla has been
stealthily co-opting older infections as a malware distribution
mechanism, not to mention taking advantage of the fact that
ANDROMEDA spreads via infected USB keys.

“USB spreading malware continues to be a useful vector^[7]
to gain initial access into organizations,” the threat intelligence
firm said.

In the incident analyzed by Mandiant, an infected USB stick is
said to have been inserted at an unnamed Ukrainian organization in
December 2021, ultimately leading to the deployment of a legacy ANDROMEDA artifact^[8] on the host upon
launching a malicious link (.LNK) file masquerading as a folder
within the USB drive.

The threat actor then repurposed one of the dormant domains that
were part of ANDROMEDA’s defunct C2 infrastructure – which it
re-registered in January 2022 – to profile the victim by delivering
the first-stage KOPILUWAK^[9]
dropper, a JavaScript-based network reconnaissance utility.

Two days later, on September 8, 2022, the attack proceeded to
the final phase with the execution of a .NET-based implant dubbed
QUIETCANARY (aka Tunnus^[10]), resulting in the
exfiltration of files created after January 1, 2021.

The tradecraft employed by Turla dovetails with prior reports of
the group’s extensive victim profiling efforts coinciding with the
Russo-Ukrainian war, potentially helping it tailor its follow-on
exploitation efforts to harvest the information of interest to
Russia.

It’s also one of the rare instances where a hacking unit has
been identified targeting victims of a different malware campaign
to meet its own strategic goals, while also obscuring its role.

“As older ANDROMEDA malware continues to spread from compromised
USB devices, these re-registered domains pose a risk as new threat
actors can take control and deliver new malware to victims,” the
researchers said.

“This novel technique of claiming expired domains used by widely
distributed, financially motivated malware can enable follow-on
compromises at a wide array of entities. Further, older malware and
infrastructure may be more likely to be overlooked by defenders
triaging a wide variety of alerts.”

COLDRIVER Targets U.S. Nuclear Research Labs

The findings also come as Reuters reported^[11] that another Russian
state-sponsored threat group codenamed COLDRIVER (aka Callisto or
SEABORGIUM) targeted three nuclear research labs in the U.S. in
early 2022.

To that end, the digital assaults entailed creating fake login
pages for Brookhaven, Argonne, and Lawrence Livermore National
Laboratories in an attempt to trick nuclear scientists into
revealing their passwords.

The tactics are consistent with known COLDRIVER activity, which
recently was unmasked^[12] spoofing the login
pages of defense and intelligence consulting companies as well as
NGOs, think tanks, and higher education entities in the U.K. and
the U.S.