Experts Uncover ‘Crutch’ Russian Malware Used in APT Attacks for 5 Years

Cyber Security

Products You May Like

Cybersecurity researchers today took the wraps off a previously undocumented backdoor and document stealer that has been deployed against specific targets from 2015 to early 2020.

Codenamed “Crutch” by ESET researchers, the malware has been attributed to Turla (aka Venomous Bear or Snake), a Russia-based advanced hacker group known for its extensive attacks against governments, embassies, and military organizations through various watering hole and spear-phishing campaigns.

“These tools were designed to exfiltrate sensitive documents and other files to Dropbox accounts controlled by Turla operators,” the cybersecurity firm said in an analysis shared with The Hacker News.

The backdoor implants were secretly installed on several machines belonging to the Ministry of Foreign Affairs in an unnamed country of the European Union.

Besides identifying strong links between a Crutch sample from 2016 and Turla’s yet another second-stage backdoor called Gazer, the latest malware in their diverse toolset points to the group’s continued focus on espionage and reconnaissance against high-profile targets.

Crutch is delivered either via the Skipper suite, a first-stage implant previously attributed to Turla, or a post-exploitation agent called PowerShell Empire, with two different versions of the malware spotted before and after mid-2019.

While the former included a backdoor that communicates with a hardcoded Dropbox account using the official HTTP API to receive commands and upload the results, the newer variant (“Crutch v4”) eschews the setup for a new feature that can automatically upload the files found on local and removable drives to Dropbox by using the Windows Wget utility.

“The sophistication of the attacks and technical details of the discovery further strengthen the perception that the Turla group has considerable resources to operate such a large and diverse arsenal,” said ESET researcher Matthieu Faou.

“Furthermore, Crutch is able to bypass some security layers by abusing legitimate infrastructure — here, Dropbox – in order to blend into normal network traffic while exfiltrating stolen documents and receiving commands from its operators.”

Products You May Like

Articles You May Like

Twitter to Limit Polls, ‘For You’ Recommendations’ to Verified Users Starting April 15
The Super Mario Bros Movie, Kisi Ka Bhai Kisi Ki Jaan, Renfield, and More: Movie Guide to Cinemas and OTT in April 2023
Madhav Sheth to Step Down as Realme India CEO, Michael Guo to Be Appointed: Reports
TikTok to Get Banned in France for Use on Smartphones of Civil Servants
WhatsApp ‘Audio Chat’ Feature Spotted in Development on Latest Android Beta: Report

Leave a Reply

Your email address will not be published. Required fields are marked *