Security News > 2021 > June > Russian Hackers Use New 'SkinnyBoy' Malware in Attacks on Military, Government Orgs
The Russia-linked threat group known as APT28 has been observed using a new backdoor in a series of attacks targeting military and government institutions, researchers with threat intelligence company Cluster25 reveal.
For initial access, the threat actor is known to use tactics such as watering hole attacks, social engineering, zero-day vulnerabilities, and stolen credentials, followed by the deployment of tools and malware that allow it to achieve persistence and gain access to information of interest.
While the tactics observed in this campaign were no different from previous attacks, what stood out was the use of a new backdoor that Cluster25's researchers have dubbed SkinnyBoy.
The attacks would start with spear-phishing emails delivering a Word document carrying malicious macros that extract a DLL designed to fetch the SkinnyBoy dropper, which achieves persistence and downloads all the components for the next stage.
The SkinnyBoy implant was designed to exfiltrate information from the infected system, as well as to fetch and run directly in memory the final payload, "Which probably exhibits typical backdoor behaviors," Cluster25 notes.
"After a period of observation of the described threat and an in-depth analysis of the identified victimology, Cluster25 team attributes the SkinnyBoy implant and the related attack to Russian group known as APT28/FancyBear with a mid-to-high confidence," the researchers conclude.
News URL
Related news
- Russian military hackers linked to critical infrastructure attacks (source)
- Russian Hackers Using Fake Brand Sites to Spread DanaBot and StealC Malware (source)
- Hackers Use Fake GlobalProtect VPN Software in New WikiLoader Malware Attack (source)
- U.S. Offers $10 Million for Info on Russian Cadet Blizzard Hackers Behind Major Attacks (source)
- Chinese hackers use new data theft malware in govt attacks (source)
- Hackers deploy AI-written malware in targeted attacks (source)
- N. Korean Hackers Deploy New KLogEXE and FPSpy Malware in Targeted Attacks (source)
- North Korean hackers exploit VPN update flaw to install malware (source)
- New CMoon USB worm targets Russians in data theft attacks (source)
- Russian-Linked Hackers Target Eastern European NGOs and Media (source)