DirtyMoe Malware Infects 2,000+ Ukrainian Computers for DDoS and Cryptojacking

The Laptop or computer Unexpected emergency Response Staff of Ukraine (CERT-UA) has warned that additional than 2,000 computer systems in the place have been infected by a pressure of malware known as DirtyMoe.

The agency attributed the marketing campaign to a threat actor it phone calls UAC-0027.

DirtyMoe, energetic since at minimum 2016, is capable of carrying out cryptojacking and distributed denial-of-service (DDoS) attacks. In March 2022, cybersecurity organization Avast uncovered the malware’s capability to propagate in a worm-like fashion by using advantage of recognized security flaws.

The DDoS botnet is known to be delivered by implies of an additional malware referred to as Purple Fox or through bogus MSI installer packages for well-liked program these kinds of as Telegram. Purple Fox is also equipped with a rootkit that allows the threat actors to hide the malware on the device and make it hard to detect and clear away.

The exact first entry vector made use of in the marketing campaign concentrating on Ukraine is presently unknown. CERT-UA is recommending that organizations retain their systems up-to-day, implement network segmentation, and check network visitors for any anomalous exercise.

The disclosure arrives as Securonix comprehensive an ongoing phishing campaign recognised as Continual#URSA concentrating on Ukrainian armed forces personnel with the objective of offering a bespoke PowerShell backdoor dubbed Refined-PAWS.

“The exploitation chain is somewhat easy: it will involve the goal executing a malicious shortcut (.lnk) file which hundreds and executes a new PowerShell backdoor payload code (uncovered inside of a different file contained inside of the identical archive),” security researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov reported.

The attack is claimed to be connected to a risk actor recognized as Shuckworm, which is also acknowledged as Aqua Blizzard (previously Actinium), Armageddon, Gamaredon, Iron Tilden, Primitive Bear, Trident Ursa, UNC530, and Winterflounder. Active considering the fact that at least 2013, it is really assessed to be part of Russia’s Federal Security Provider (FSB).

Refined-PAWS, in addition to environment up persistence on the host, utilizes Telegram’s running a blog system referred to as Telegraph to retrieve the command-and-regulate (C2) information and facts, a system earlier identified as linked with the adversary because early 2023, and can propagate by detachable connected drives.

Gamaredon’s capability to distribute via USB drives was also documented by Look at Issue in November 2023, which named the PowerShell-primarily based USB worm LitterDrifter.

“The Delicate-PAWS backdoor uses superior procedures to execute malicious payloads dynamically,” the scientists reported.

“They shop and retrieve executable PowerShell code from the Windows Registry which can support in evading common file-based detection procedures. This approach also aids in sustaining persistence on the contaminated system, as the malware can initiate itself yet again soon after reboots or other interruptions.”

Located this article exciting? Stick to us on Twitter  and LinkedIn to go through more unique content material we publish.

Some parts of this article are sourced from:
thehackernews.com