New APT Group

Jul 08, 2024NewsroomCyber Espionage / Cloud Security

A previously undocumented advanced persistent threat (APT) group dubbed CloudSorcerer has been observed targeting Russian government entities by leveraging cloud services for command-and-control (C2) and data exfiltration.

Cybersecurity firm Kaspersky, which discovered the activity in May 2024, said the tradecraft adopted by the threat actor bears similarities with that of CloudWizard, but pointed out the differences in the malware source code. The attacks wield an innovative data-gathering program and a slew of evasion tactics for covering its tracks.

“It’s a sophisticated cyber espionage tool used for stealth monitoring, data collection, and exfiltration via Microsoft Graph, Yandex Cloud, and Dropbox cloud infrastructure,” the Russian security vendor said.

“The malware leverages cloud resources as its command and control (C2) servers, accessing them through APIs using authentication tokens. Additionally, CloudSorcerer uses GitHub as its initial C2 server.”

The exact method used to infiltrate targets is currently unknown, but the initial access is exploited to drop a C-based portable executable binary that’s used as a backdoor, initiate C2 communications, or inject shellcode into other legitimate processes based on the process in which it is executed – namely mspaint.exe, msiexec.exe, or contains the string “browser.”

“The malware’s ability to dynamically adapt its behavior based on the process it is running in, coupled with its use of complex inter-process communication through Windows pipes, further highlights its sophistication,” Kaspersky noted.

The backdoor component is designed to collect information about the victim machine and retrieve instructions to enumerate files and folders, execute shell commands, perform file operations, and run additional payloads.

The C2 module, for its part, connects to a GitHub page that acts as a dead drop resolver to fetch an encoded hex string pointing to the actual server hosted on Microsoft Graph or Yandex Cloud.

“Alternatively, instead of connecting to GitHub, CloudSorcerer also tries to get the same data from hxxps://my.mail[.]ru/, which is a Russian cloud-based photo hosting server,” Kaspersky said. “The name of the photo album contains the same hex string.”

“The CloudSorcerer malware represents a sophisticated toolset targeting Russian government entities. Its use of cloud services such as Microsoft Graph, Yandex Cloud, and Dropbox for C2 infrastructure, along with GitHub for initial C2 communications, demonstrates a well-planned approach to cyber espionage.”

Update

Enterprise security firm Proofpoint said it detected a cyber campaign targeting an unnamed U.S.-based organization mirroring the tactics of CloudSorcerer. It’s tracking the activity under the moniker UNK_ArbitraryAcrobat.

The attack, observed in late May 2024, is said to have used a freemail account impersonating a well-known U.S. think tank and leveraged a fake event invitation as a lure to trick recipients into downloading a ZIP archive file hosted on acrobat-inst[.]com.

“If the ZIP file is downloaded and opened, a user is presented with a folder and three LNK files, all of which can be used to start the chain of malicious activity,” the company said.

“The LNKs will launch either the PDF or Word Document embedded in the folder, then rename various components in the folder to new names, and then launch an embedded executable file, cache.tmp.”

The loaded process subsequently reaches out to GitHub or TechNet profiles to fetch a hex-style blob that starts and ends with the same byte pattern “CDOY,” matching observations made by Kaspersky.

Proofpoint threat researcher Greg Lesnewich told The Hacker News that the latest findings indicate the threat actor is employing spear-phishing techniques to infiltrate networks, although the possibility of other delivery methods cannot be ruled out. There is currently no evidence to suggest that the adversary is “targeting anything besides Windows operating systems.”

(The story was updated after publication to include additional comments from Proofpoint.)