Mandiant Suspected Turla Campaign February 2023

During C0026, the threat actors collected documents from compromised hosts.

KOPILUWAK can gather information from compromised hosts.

QUIETCANARY has the ability to retrieve information from the Registry.

KOPILUWAK can use Arp to discover a target's network configuration setttings.

QUIETCANARY can identify the default proxy setting on a compromised host.

During C0026, the threat actors split encrypted archives containing stolen files and information into 3MB parts prior to exfiltration.

KOPILUWAK can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details.

ANDROMEDA has been installed to `C:\Temp\TrustedInstaller.exe` to mimic a legitimate Windows installer service.

ANDROMEDA has been delivered through a LNK file disguised as a folder.

KOPILUWAK has exfiltrated collected data to its C2 via POST requests.

KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.

ANDROMEDA can inject into the `wuauclt.exe` process to perform C2 actions.

KOPILUWAK can enumerate current running processes on the targeted machine.

KOPILUWAK had used Javascript to perform its core functions.

ANDROMEDA has the ability to make GET requests to download files from C2.

KOPILUWAK has used HTTP POST requests to send data to C2.

QUIETCANARY can use HTTPS for C2 communications.

QUIETCANARY has the ability to stage data prior to exfiltration.

KOPILUWAK has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine.

ANDROMEDA has been spread via infected USB keys.

During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.

ANDROMEDA can download additional payloads from C2.

QUIETCANARY can call `System.Net.HttpWebRequest` to identify the default proxy configured on the victim computer.

QUIETCANARY can base64 encode C2 communications.

KOPILUWAK can use netstat and Net to discover network shares.

QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them.

KOPILUWAK has gained execution through malicious attachments.

ANDROMEDA can establish persistence by dropping a sample of itself to `C:\ProgramData\Local Settings\Temp\mskmde.com` and adding a Registry run key to execute every time a user logs on.

During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.

QUIETCANARY can execute processes in a hidden window.

KOPILUWAK has been delivered to victims as a malicious email attachment.

During C0026, the threat actors re-registered a ClouDNS dynamic DNS subdomain which was previously used by ANDROMEDA.

QUIETCANARY can RC4 encrypt C2 communications.

For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.

KOPILUWAK can discover logical drive information on compromised hosts.