A new cyber campaign has been identified, targeting victims in Azerbaijan with Rust-based malware. Cybersecurity firm Deep Instinct is tracking the operation under the name Operation Rusty Flag. Currently, it has not been associated with any known threat actor or group.
According to security researchers Simon Kenin, Ron Ben Yizhak, and Mark Vaitzman, the operation has at least two different initial access vectors. One of the lures used in the operation is a modified document that was used by the Storm-0978 group which could be a deliberate ‘false flag.’
The attack chain leverages an LNK file named 1.KARABAKH.jpg.lnk as a launchpad to retrieve a second-stage payload, an MSI installer, hosted on Dropbox.
The installer file drops an implant written in Rust, an XML file for a scheduled task to execute the implant, and a decoy image file that features watermarks of the symbol of the Azerbaijan Ministry of Defense.
An alternate infection vector is a Microsoft Office document named “Overview_of_UWCs_UkraineInNATO_campaign.docx,” that exploits CVE-2017-11882, a known memory corruption vulnerability in Microsoft Office’s Equation Editor, to invoke a Dropbox URL hosting a different MSI file serving a variant of the same Rust backdoor.
The Rust backdoor masquerades as “WinDefenderHealth.exe,” which is capable of collecting information from the compromised host and send it to an attacker-controlled server.
The exact end goals of the campaign is not clear at the moment. At the same time, the possibility that it could be a red team exercise has not been discounted.
The researchers stated that Rust is becoming more popular among malware authors and the security products are not yet detecting it accurately, and the reverse engineering process is more complex.
Comments