‘Awaken Likho’ Cyberattack Faction Focuses on Russian Authority Using Sophisticated Instruments
Russian authoritative bureaus and industrial establishments are the prime focus of a sustained endeavor cluster known as Awaken Likho.
In a recent announcement, Kaspersky mentioned that the perpetrators are now opting for the agent for the legitimate MeshCentral platform rather than the previously employed UltraVNC module to secure remote access to systems. This marks the initiation of a new operation in June 2024 that persisted till August.
The cyber defense firm from Russia highlighted that the operation primarily aimed at Russian official bodies, their associates, and industrial corporations.
Initially identified by BI.ZONE in June 2023 in connection with cyber offensives targeted at defense and critical infrastructure sectors, Awaken Likho, also known as Core Werewolf and PseudoGamaredon, has been active since at least August 2021.
The email-based attacks involve disseminating malicious executables disguised as Microsoft Word or PDF documents by affixing double extensions like “doc.exe,” “.docx.exe,” or “.pdf.exe,” concealing the .docx and .pdf sections of the extension from users.
Upon opening these files, it was found that UltraVNC was installed, granting the threat actors full control over the infected machines.
Other attacks orchestrated by Core Werewolf have also identified a military station in Armenia and a research institution in Russia engaged in armaments development, according to updates from F.A.C.C.T. in May.
A significant change observed in these incidents relates to the deployment of a self-extracting archive (SFX) to simplify the covert injection of UltraVNC while showcasing an innocuous decoy document to the victims.
The most recent assault mechanism uncovered by Kaspersky also relies on an SFX archive file generated using 7-Zip that, upon opening, triggers the activation of a file named “MicrosoftStores.exe,” leading to the extraction of an AutoIt script which, in turn, executes the open-source MeshAgent remote management utility.
“These maneuvers enable the APT group to maintain a presence in the system: the attackers create a scheduled assignment that executes a command script, which, in turn, initiates MeshAgent to set up a connection with the MeshCentral server,” as stated by Kaspersky.
About Author
