Government organizations in Central Asia are being targeted by a sophisticated espionage campaign leveraging a previously undocumented variety of malware, called DownEx.
Bitdefender, in a report shared with The Hacker News, said the activity remains active, with evidence likely pointing to the involvement of Russian-based threat actors.
The Romanian cybersecurity firm said it first detected the malware in a highly targeted attack on foreign government institutions in Kazakhstan in late 2022. Another attack was later observed in Afghanistan.
The use of a diplomatically themed decoy document and the campaign’s focus on exfiltrating data suggest the involvement of a state-sponsored group, although the hacking outfit’s exact identity remains being undetermined at this stage.
The initial intrusion vector for the campaign is suspected to be a spear phishing email that carries an explosive payload, which is a loader executable masquerading as a Microsoft Word file.
Opening the attachment results in the extraction of two files, including a deceptive document that is displayed to the victim while running a malicious HTML application (.HTA) with embedded VBScript code in the background.
The HTA file, on the other hand, is designed to establish contact with a remote command and control server (C2) to retrieve a payload from the next stage. While the exact nature of the malware is unknown, it is said to be a backdoor to establish persistence.
The attacks are also notable for the use of a variety of custom tools to perform post-exploitation activities. This includes –
- Two C/C++ based binaries (wnet.exe and utility.exe) to enumerate all resources on a network,
- A Python script (help.py) to establish an infinite communication loop with the C2 server and receive instructions to steal files with certain extensions, delete files created by other malicious programs, and capture screenshots and
- A C++-based malware (diagsvc.exe aka DownEx) that is primarily designed to exfiltrate files on the C2 server
Learn how to stop ransomware with real-time protection
Join our webinar and learn how to stop ransomware attacks with real-time MFA and service account protection.
Save my seat!
Two other variants of DownEx have also landed, the first of which executes an intermediate VBScript to collect and transmit the files in ZIP archive form.
The other version, which is downloaded via a VBE script (slmgr.vbe) from a remote server, avoids C++ for VBScript, but retains the same functionality as before.
“This is a fileless attack: the DownEx script runs in memory and never touches the disk,” Bitdefender said. “This attack highlights the sophistication of a modern cyberattack. Cybercriminals are finding new methods to make their attacks more reliable.”
Source link
A sophisticated new malware campaign is targeting Central Asian governments, and more organizations should be aware of it. The malicious software, called DownEx, was identified by Ikaroa, a full-stack tech company that specializes in network security.
DownEx is able to evade detection and can exploit several vulnerabilities to gain access to the systems of vulnerable Central Asian governments. Once inside, the malware can harvest data, download files, upload files, and exfiltrate information. It can even alter the operating system and modify the file system of its target.
Damage caused by DownEx is difficult to quantify, but it could potentially have a long-term impact on the infrastructure of targeted countries. Consequently, governments must invest resources to protect their systems from this cyber threat.
Ikaroa advises all organizations to take preventive action and patch their systems to stay secure from DownEx. The company also encourages the use of anti-malware programs to scan for suspicious activities and the use of secure protocols for communication on a regular basis.
In addition, organizations should limit their exposure to potential sources of DownEx by limiting privileges to authorized users, implementing least-privilege access, and disabling unnecessary services.
Given the severity of the threat, Central Asian governments must take decisive action to protect their systems from DownEx. With the help of Ikaroa and its security solutions, the government can mitigate the risks posed by this sophisticated malware and make sure the integrity of their systems is maintained.
