Government organizations in Central Asia have become the target of a sophisticated espionage campaign that leverages a previously undocumented strain of malware dubbed DownEx. According to the findings of Romanian cybersecurity firm Bitdefender, this activity is still active and evidently points to the involvement of Russia-based threat actors. The report highlights the campaign’s first detection in a highly targeted attack on foreign government institutions in Kazakhstan in late 2020.
Based on the report findings, the campaign’s use of a diplomat-themed lure document and its focus on data exfiltration suggest the involvement of a state-sponsored group. However, the exact identity of the hacking group remains indeterminate at this stage. Bitdefender reveals that the initial intrusion vector for the campaign is suspected to be a spear-phishing email containing a booby-trapped payload. The report further delves in-depth into each layer of the attack process and the technical details of the malware to offer a complete overview of the threat.
Use of Diplomat-Themed Lure Document
The lure document uses the theme of Diplomacy, belonging to country-specific foreign service agencies. The document has macros disabled, which is a typical prevention mechanism used by large organizations to prevent malicious behavior of Word files. However, the attackers used a loader executable, disguised as a Word file, that initiated a PowerShell script when opened. This script downloaded and ran another Windows executable.
Custom-designed tools for post-exploitation activities
The campaign also employs a variety of custom tools for carrying out the post-exploitation activities. This includes two C/C++-based binaries (wnet.exe and utility.exe) to enumerate all the resources on a network, a Python script (help.py) to establish an infinite communication loop with the C2 server, and a C++-based malware (diagsvc.exe), aka DownEx. DownEx is primarily used to exfiltrate files to the C2 server.
Different variants of DownEx malware
Two other variants of DownEx have also been discovered, providing insight into how the hackers were able to continue their campaign. The first variant executes an intermediate VBScript to harvest and transmit the files in the form of a ZIP archive. The other version, which is downloaded via a VBE script (slmgr.vbe) from a remote server, uses VBScript instead of C++. This variant retains the same functionality as the former, making it easier for the hackers to switch between variants and making their attacks difficult to trace.
Fileless attack
The report highlights a critical point that makes DownEx malware extremely difficult to detect – it’s a fileless attack. This means that the script executed by the attackers is held entirely in memory and never touches the disk, making it impossible for traditional antivirus solutions to detect the activities of the hackers. The report further explains the use of a legitimate Windows process, such as svchost.exe, to execute the malware from memory, making it difficult to detect and track.
A sophisticated and reliable cyberattack
Finally, the report drives home an important message – modern cyberattacks continue to become more sophisticated and efficient. Cybercriminals are continually finding new methods of making their attacks more reliable while also making it more challenging to identify, combat, and prevent the attacks. The use of previously undocumented malware strain trends demands advanced cybersecurity measures, such as new techniques for spotting fileless attacks, first-risk management strategies, and collaborative actions between government agencies and private institutions.
The Bitdefender report offers a glimpse into how cybercriminals continue to sharpen and refine their attack tactics, while making the process of tracking the source of the attack even harder. The ongoing DownEx malware attack, its focus on government agencies, and the report’s evidence of state-sponsored involvement, are all concerning developments. Effective cybersecurity management will continue to be necessary to prevent and mitigate damages from such attacks. As we witnessed in this case, the use of custom-designed tools, fileless attack methods, and advanced spear-phishing techniques, make it essential to continually adapt and innovate cybersecurity strategies.