TaxOff: You've Got a Backdoor...
Essential information
- Published
- 03/12/2024 16:26
- Modified
- 03/12/2024 16:50
- Tags
- 2024-12-03 code injection espionage keylogging phishing russian government trinper backdoor
- Related entities
- 11 observables, 1 intrusion sets (apt), 14 techniques (mitre), 1 malware, 2 others
Description
A sophisticated threat group named TaxOff has been discovered targeting Russian government agencies. The group uses phishing emails with legal and financial themes to deliver the Trinper backdoor, a multithreaded C++ malware with advanced features. Trinper employs STL containers, custom serialization, and a buffer cache for improved performance. It can inject code, manipulate files, execute commands, and perform keylogging. The backdoor communicates with command and control servers using encrypted channels and domain fronting techniques. TaxOff's combination of convincing social engineering and a complex backdoor makes their attacks particularly dangerous and difficult to detect.