Targets Ukraine's Defense Forces using SPECTR malware alongside legitimate SyncThing
Essential information
- Published
- 07/06/2024 08:33
- Modified
- 07/06/2024 09:09
- Tags
- 2024-06-07 defense exfiltration spectr syncthing ukraine
- Related entities
- 33 observables, 1 intrusion sets (apt), 19 techniques (mitre), 1 malware, 3 others
Description
The report describes a cyber attack campaign by the UAC-0020 (Vermin) threat group targeting Ukraine's Defense Forces. The attackers utilized the SPECTR malware in tandem with the legitimate SyncThing software to exfiltrate sensitive data. The malicious payload was delivered via a password-protected archive containing a decoy PDF and an installer that deployed both SyncThing's legitimate components and SPECTR's malicious modules. SPECTR's capabilities included screen capture, file theft, password exfiltration, and the ability to steal data from messaging apps and browsers. The stolen data was covertly synced to the attackers' infrastructure by leveraging SyncThing's P2P functionality.