A continuous operation known as Awaken Likho has been directed towards Russian government agencies and industrial entities.
Kaspersky revealed the usage of the MeshCentral platform by the attackers instead of the previously employed UltraVNC module for gaining remote access to systems. This new campaign commenced in June 2024 and persisted at least until August, as per Kaspersky’s statement.
The cyber defense firm specified that the campaign’s primary focus was on Russian government agencies, their suppliers, and industrial firms.
Core Werewolf, also identified as Awaken Likho and PseudoGamaredon, was initially observed by BI.ZONE in June 2023, concerning cyber assaults aimed at defense and critical infrastructure areas. This group is assumed to have been active since at least August 2021.
The spear-phishing tactics include the distribution of malicious executables camouflaged as Microsoft Word or PDF files with double extensions like “doc.exe,” “.docx.exe,” or “.pdf.exe,” showing only the initial document format extensions to users.
Upon opening these files, the UltraVNC gets installed, granting the threat actors full control over the compromised systems.
Previously, attacks by Core Werewolf had also targeted a Russian military base in Armenia and a Russian institute involved in weapon development, based on the findings by F.A.C.C.T. from May of the same year.
An interesting change in these scenarios is the adoption of a self-extracting archive (SFX) to covertly install UltraVNC while presenting an innocuous bait document to the victims.
Kaspersky’s latest discovery indicates an attack chain where an SFX archive file produced using 7-Zip triggers the execution of a file named “MicrosoftStores.exe” when opened, leading to the unpacking of an AutoIt script to ultimately activate the open-source remote management tool MeshAgent.
These tactics enable the APT to remain hidden within the system, with the attackers setting up a scheduled task that launches MeshAgent via a command file, establishing a link with the MeshCentral server, according to Kaspersky.
About Author
