Looking for a Shorter Overview?
AI Summary
Key Moments
Ghostwriter group goals and connections
A Belarusian threat actor linked to Russian interests is attacking opposition and Ukrainian institutions.Excel macros as an infection technique
Malicious Excel VBA macros are used to download and run Picassoloader via DLL files.Steganography for malware delivery
Hidden payloads are punched into seemingly harmless JPEG images in attached Excel documents.Using Libcmd and .NET downloaders
A DLL that runs cmd.exe is loaded into memory via .NET for invisible execution of malicious code.Ghostwriter group behind new attacks. Opposition activists in Belarus as well as Ukrainian military and government organizations are the targets of a new campaign using Microsoft Excel-malware documents as bait to deliver a new variant of Picassoloader.
The threat cluster has been assessed to be an extension of a long-term campaign mounted by a Belarus-aligned threat actor known as Ghostwriter (alias Moonscape, TA445, UAC-0057 and UNC1151) since 2016. It is known to align with Russian security interests and promote narratives critical of NATO.
Campaign timeline and activation
“The campaign has been in preparation since July-August 2024 and entered the active phase in November-December 2024,” he said. SentinelOne-the researcher Tom Hegel in a technical report.
New discoveries:
- Malware samples and command-and-control (C2) infrastructure activity suggests that the operation remains active.
- The attack chain starts with a shared Google Drive-document, hosting a malicious RARE-archives.
The technology behind the attacks
Excel macros as tools for infection
The RAR file contains a malicious Excel VBA-workbook, which when opened triggers a obfuscated macro. If the user enables macros, a DLLfile to the system, which in turn starts a simplified version of Picassoloader.
Steganography and invisible malware
In the next phase, a Decoy Excel file for the victim, while additional payloads are downloaded in the background. As recently as June 2024, this was used technique to deliver Cobalt Strike-framework.
SentinelOne also identified other armed Excel document who uses Ukraine theme as baitThese documents download malware via steganography, where a seemingly harmless JPG image contains hidden malicious code.
Using Libcmd and .NET downloaders
In some cases, the infected The Excel document to deliver a DLL by name Libcmd, who runs cmd.exe and connects to stdin/stdout. It is loaded directly into memory as a .NET-mounting and running without leaving traces on the disk.
Ghostwriters' continued threats against Ukraine
“In 2024, Ghostwriter repeatedly used a combination of Excel workbooks with MacroPack-obfuscated VBA macros and embedded .NET Downloader, says Hegel.
Despite the fact that Belarus not participating militarily in the war in Ukraine, cyber threat actors linked to the country remain active in cyber espionage operations against Ukrainian targets.
Swedish
Danish
Norwegian
Finnish
English
German
Dutch