CommonMagic APT Marketing campaign Broadens Goal Scope to Central and Western Ukraine

Woburn, MA – Might 19, 2023 – Kaspersky researchers have offered additional particulars on the CommonMagic marketing campaign, which was first noticed in March concentrating on corporations within the Russo-Ukrainian battle space. The brand new analysis reveals extra refined malicious actions from the identical menace actor. The investigation recognized that the newly-discovered framework has expanded its victimology to incorporate organizations in Central and Western Ukraine. Kaspersky specialists have additionally linked the unknown actor to earlier APT campaigns, corresponding to Operation BugDrop and Operation Groundbai (Prikormka).

In March 2023, Kaspersky reported a brand new APT marketing campaign within the Russo-Ukrainian battle space. This marketing campaign, named CommonMagic, makes use of PowerMagic and CommonMagic implants to conduct espionage actions. Lively since September 2021, it employs a beforehand unidentified malware to gather information from focused entities. Though the menace actor answerable for this assault remained unknown on the time, Kaspersky specialists have endured with their investigation, tracing the unknown exercise again to forgotten campaigns as a way to collect additional insights.

The just lately uncovered marketing campaign utilized a modular framework referred to as CloudWizard. Kaspersky’s analysis recognized a complete of 9 modules inside this framework, every answerable for distinct malicious actions corresponding to gathering recordsdata, keylogging, capturing screenshots, recording microphone enter, and stealing passwords. Notably, one of many modules focuses on exfiltrating information from Gmail accounts. By extracting Gmail cookies from browser databases, this module can entry and smuggle exercise logs, contact lists, and all e-mail messages related to the focused accounts.

Moreover, the researchers have uncovered an expanded sufferer distribution within the marketing campaign. Whereas the earlier targets had been primarily situated within the Donetsk, Luhansk, and Crimea areas, the scope has now widened to incorporate people, diplomatic entities, and analysis organizations in Western and Central Ukraine.

After in depth analysis into CloudWizard, Kaspersky specialists have made important progress in attributing it to a identified menace actor. They’ve noticed notable similarities between CloudWizard and two beforehand documented campaigns: Operation Groundbait and Operation BugDrop. These similarities embody code similarities, file naming and itemizing patterns, internet hosting by Ukrainian internet hosting providers, and shared sufferer profiles in Western and Central Ukraine, in addition to the battle space in Jap Europe.

Furthermore, CloudWizard additionally reveals resemblances to the just lately reported marketing campaign CommonMagic. Some sections of the code are similar, they make use of the identical encryption library, observe an identical file naming format, and share sufferer areas inside the Jap European battle space.

Based mostly on these findings, Kaspersky specialists have concluded that the malicious campaigns of Prikormka, Operation Groundbait, Operation BugDrop, CommonMagic, and CloudWizard might all be attributed to the identical energetic menace actor.  

“The menace actor answerable for these operations has demonstrated a persistent and ongoing dedication to cyberespionage, constantly enhancing their toolset and concentrating on organizations of curiosity for over fifteen years,” stated Georgy Kucherin, safety researcher at Kaspersky’s World Analysis and Evaluation Staff. “Geopolitical elements proceed to be a big motivator for APT assaults and, given the prevailing pressure within the Russo-Ukrainian battle space, we anticipate that this actor will stick with its operations for the foreseeable future.”

Learn the complete report in regards to the CloudWizard marketing campaign on Securelist.

With the intention to keep away from falling sufferer to a focused assault by a identified or unknown menace actor, Kaspersky researchers suggest implementing the next measures:

• Present your SOC workforce with entry to the newest menace intelligence (TI). The Kaspersky Threat Intelligence Portal is a single level of entry for the corporate’s TI, offering it with cyberattack information and insights gathered by Kaspersky spanning over 20 years.
• Upskill your cybersecurity workforce to deal with the newest focused threats with Kaspersky online training developed by GReAT specialists
• For endpoint degree detection, investigation, and well timed remediation of incidents, implement EDR options corresponding to Kaspersky Endpoint Detection and Response
• Along with adopting important endpoint safety, implement a corporate-grade safety answer that detects superior threats on the community degree at an early stage, corresponding to Kaspersky Anti Targeted Attack Platform
• As many focused assaults begin with phishing or different social engineering methods, introduce safety consciousness coaching and educate sensible abilities to your workforce – for instance, by way of the Kaspersky Automated Security Awareness Platform