Blog
/
/
August 9, 2022

Cyber Tactics in the Russo-Ukrainian Conflict

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
09
Aug 2022
The conflict between Russia and Ukraine has led to fears of a full-scale cyberwar. Learn the cyber attack tactics used, hacking groups involved, and more!

Introduction

Since the beginning of the Russian invasion of Ukraine in February 2022, cyber communities around the world have been witnessing what can be called a ‘renaissance of cyberwarfare' [1]. Rather than being financially motivated, threat actors are being guided by political convictions to defend allies or attack their enemies. This blog reviews some of the main threat actors involved in this conflict and their ongoing tactics, and advises on how organizations can best protect themselves. Darktrace’s preliminary assessments predicted that attacks would be observed globally with a focus on pro-Ukrainian nations such as North Atlantic Treaty Organization (NATO) members and that identified Advanced Persistent Threat (APT) groups would develop new and complex malware deployed through increasingly sophisticated attack vectors. This blog will show that many of these assessments had unexpected outcomes.

Context for Conflict 

Cyber confrontation between Russia and Ukraine dates back to 2013, when Viktor Yanukovych, (former President of Ukraine) rejected an EU trade pact in favour of an agreement with Russia. This sparked mass protests leading to his overthrow, and shortly after, Russian troops annexed Crimea and initiated the beginning of Russian-Ukrainian ground and cyber warfare. Since then, Russian threat actors have been periodically targeting Ukrainian infrastructure. One of the most notable examples of this, an attack against their national power grid in December 2015, resulted in power outages for approximately 255,000 people in Ukraine and was later attributed to the Russian hacking group Sandworm [2 & 3]. 

Another well-known attack in June 2017 overwhelmed the websites of hundreds of Ukrainian organizations using the infamous NotPetya malware. This attack is still considered the most damaging cyberattack in history, with more than €10 billion euros in financial damage [4]. In February 2022, countries witnessed the next stage of cyberwar against Ukraine with both new and familiar actors deploying various techniques to target their rival’s critical infrastructure. 

Tactic 1: Ransomware

Although some sources suggest US ransomware incidents and expectations of ransom may have declined during the conflict, ransomware still remained a significant tactic deployed globally across this period [5] [6] [7]. A Ukrainian hacking group, Network Battalion 65 (NB65), used ransomware to attack the Russian state-owned television and radio broadcasting network VGTRK. NB65 managed to steal 900,000 emails and 4000 files, and later demanded a ransom which they promised to donate to the Ukrainian army. This attack was unique because the group used the previously leaked source code of Conti, another infamous hacker group that had pledged its support to the Russian government earlier in the conflict. NB65 modified the leaked code to make unique ransomware for each of its targets [5]. 

Against expectations, Darktrace’s customer base appeared to deviate from these ransom trends. Analysts have seen relatively unsophisticated ransomware attacks during the conflict period, with limited evidence to suggest they were connected to any APT activity. Between November 2021 and June 2022, there were 51 confirmed ransomware compromises across the Darktrace customer base. This represents an increase of 43.16% compared to the same period the year before, accounting for relative customer growth. Whilst this suggests an overall growth in ransom cases, many of these confirmed incidents were unattributed and did not appear to be targeting any particular verticals or regions. While there was an increase in the energy sector, this could not be explicitly linked to the conflict. 

The Darktrace DETECT family has a variety of models related to ransomware visibility:

Darktrace Detections for T1486 (Data Encrypted for Impact):

- Compromise / Ransomware / Ransom or Offensive Words Written to SMB

- Compromise / Ransomware / Suspicious SMB Activity

- Anomalous Connection / Sustained MIME Type Conversion

- Unusual Activity / Sustained Anomalous SMB Activity

- Compromise / Ransomware / Suspicious SMB File Extension

- Unusual Activity / Anomalous SMB Read & Write

- Unusual Activity / Anomalous SMB Read & Write from New Device

- SaaS / Resource / SaaS Resources with Additional Extensions

- Compromise / Ransomware / Possible Ransom Note Read

- [If RESPOND is enabled] Antigena / Network / External Threat / Antigena Ransomware Block

Tactic 2: Wipers

One of the largest groups of executables seen during the conflict were wipers. On the eve of the invasion, Ukrainian organizations were targeted by a new wiper malware given the name “HermeticWiper”. Hermetic refers to the name of the Cyprian company “Hermetica Digital Ltd.” which was used by attackers to request a code signing certificate [6]. Such a digital certificate is used to verify the ownership of the code and that it has not been altered. The 24-year-old owner of Hermetica Digital says he had no idea that his company was abused to retrieve a code signing certificate [7]. 

HermeticWiper consists of three components: a worm, decoy ransomware and the wiper malware. The custom worm designed for HermeticWiper was used to spread the malware across the network of its infected machines. ESET researchers discovered that the decoy ransomware and the wiper were released at the same time [8]. The decoy ransomware was used to make it look like the machine was hit by ransomware, when in reality the wiper was already permanently wiping data from the machines. In the attack’s initial stage, it bypasses Windows security features designed to prevent overwriting boot records by installing a separate driver. After wiping data from the machine, HermeticWiper prevents that data from being re-fragmented and overwrites the files to fragment it further. This is done to make it more challenging to reconstruct data for post-compromise forensics [9]. Overall, the function and purpose of HermeticWiper seems similar to that of NotPetya ransomware. 

HermeticWiper is not the only conflict-associated wiper malware which has been observed. In January 2022, Microsoft warned Ukrainian customers that they detected wiper intrusion activity against several European organizations. One example of this was the MBR (Master Boot Record) wiper. This type of wiper overwrites the MBR, the disk sector that instructs a computer on how to load its operating system, with a ransomware note. In reality, the note is a misdirection and the malware destroys the MBR and targeted files [10].  

One of the most notable groups that used wiper malware was Sandworm. Sandworm is an APT attributed to Russia’s foreign military intelligence agency, GRU. The group has been active since 2009 and has used a variety of TTPs within their attacks. They have a history of targeting Ukraine including attacks in 2015 on Ukraine’s energy distribution companies and in 2017 when they used the aforementioned NotPetya malware against several Ukrainian organizations [11]. Another Russian (or pro-Russian) group using wiper malware to target Ukraine is DEV-0586. This group targeted various Ukrainian organizations in January 2022 with Whispergate wiper malware. This type of wiper malware presents itself as ransomware by displaying a file instructing the victim to pay Bitcoin to have their files decrypted [12].  

Darktrace did not observe any confirmed cases of HermeticWiper nor other conflict-associated wipers (e.g IsaacWiper and CaddyWiper) within the customer base over this period. Despite this, Darktrace DETECT has a variety of models related to wipers and data destruction:

Darktrace Detections for T1485 (Data Destruction)- this is the main technique exploited during wiper attacks

- Unusual Activity / Anomalous SMB Delete Volume

- IaaS / Unusual Activity / Anomalous AWS Resources Deleted

- IaaS / Storage / S3 Bucket Delete

- SaaS / Resource / Mass Email Deletes from Rare Location

- SaaS / Resource / Anomalous SaaS Resources Deleted

- SaaS / Resource / Resource Permanent Delete

- [If RESPOND is enabled] Antigena / Network / Manual / Enforce Pattern of Life

- [If RESPOND is enabled] Antigena / SaaS / Antigena Unusual Activity Block

Tactic 3: Spear-Phishing

Another strategy that some threat actors employ is spear-phishing. Targeting can be done using email, social media, messaging, or other platforms.

The hacking group Armageddon (also known as Gamaredon) has been responsible for several spear-phishing attacks during the crisis, primarily targeting individuals involved in the Ukrainian Government [13]. Since the beginning of the war, the group has been sending out a large volume of emails containing an HTML file which, if opened, downloads and launches a RAR payload. Those who click the attached link download an HTA with a PowerShell script which obtains the final Armageddon payload. Using the same strategy, the group is also targeting governmental agencies in the European Union [14]. With high-value targets, the need to improve teaching around phishing identification to minimize the chance of being caught in an attacker's net is higher than ever. 

In comparison to the wider trends, Darktrace analysts again saw little-to-no evidence of conflict-associated phishing campaigns affecting customers. Those phishing attempts which did target customers were largely not conflict-related. In some cases, the conflict was used opportunistically, such as when one customer was targeted with a phishing email referencing Russian bank exclusions from the SWIFT payment system (Figures 1 and 2). The email was identified by Darktrace/Email as a probable attempt at financial extortion and inducement - in this case the company received a spoofed email from a major bank’s remittance department.  

Figure 1- Screencap of targeted phishing email sent to Darktrace customer
Figure 2- Attached file contains soliciting reference to SWIFT, a money payment system which select Russian banks were removed from because of the conflict [15]

 Although the conflict was used as a reference in some examples, in most of Darktrace’s observed phishing cases during the conflict period there was little-to-no evidence to suggest that the company being targeted nor the threat actor behind the phishing attempt was associated with or attributable to the Russia-Ukraine conflict.

However, Darktrace/Email has several model categories which pick up phishing related threats:

Sample of Darktrace for Email Detections for T1566 (Phishing)- this is the overarching technique exploited during spear-phishing events

Model Categories:

- Inducement

- Internal / External User Spoofing

- Internal / External Domain Spoofing

- Fake Support

- Link to Rare Domains

- Link to File Storage

- Redirect Links

- Anomalous / Malicious Attachments

- Compromised Known Sender

Specific models can be located on the Email Console

 

Tactic 4: Distributed-Denial-of-Service (DDoS)

Another tactic employed by both pro-Russian and pro-Ukrainian threat actors was DDoS (Distributed Denial of Service) attacks. Both pro-Russia and pro-Ukraine actors were seen targeting critical infrastructure, information resources, and governmental platforms with mass DDoS attacks. The Ukrainian Minister of Digital Transformation, Mykhailo Fedorov, called on an IT Army of underground Ukrainian hackers and volunteers to protect Ukraine's critical infrastructure and conduct DDoS attacks against Russia [16]. As of 1 August 2022, more than two hundred thousand people are subscribed to the group's official Telegram channel, where potential DDoS targets are announced [17].

Darktrace observed similar pro-Ukraine DDoS behaviors within a variety of customer environments. These DDoS campaigns appeared to involve low-volume individual support combined with crowd-sourced DDoS activity. They were hosted on a range of public-sourced DDoS sites and seemed to share sentiments of groups such as the IT Army of Ukraine (Figure 3).

Figure 3- Example DDoS outsource domain with unusual TLD 

From the Russian side, one of the prominent newly emerged groups, Killnet, is striking back, launching several massive DDoS attacks against the critical infrastructure of countries that provide weaponry to Ukraine [18 & 19]. Today, the number of supporters of Killnet has grown to eighty-four thousand on their Telegram channel. The group has already launched a number of mass attacks on several NATO states, including Germany, Poland, Italy, Lithuania and Norway. This shows the conflict has attracted new and fast-growing groups with large backing and the capacity to undertake widespread attacks. 

DETECT has several models to identify anomalous DoS/DDoS activity:

Darktrace Detection for T1498 (Network Denial of Service)- this is the main technique exploited during DDoS attacks

- Device / Anomaly Indicators / Denial of Service Activity Indicator

- Anomalous Server Activity / Possible Denial of Service Activity

- [If RESPOND is enabled] Antigena / Network / External Threat / Antigena Suspicious Activity Block

What did Darktrace observe?

Darktrace’s cross-fleet detections were largely contrary to expectations. Analysts did not see large-scale complex conflict-linked attacks utilizing either conflict-associated ransomware, malware, or other TTPs. Instead, cyber incidents observed were largely opportunistic, using malware that could be purchased through Malware-as-a-Service models and other widely available toolkits, (rather than APT or conflict-attributable attacks). Overall, this is not to say there have been no repercussions from the conflict or that opportunistic attacks will cease, but evidence suggests that there were fewer wider cyber consequences beyond the initial APT-based attacks seen in the public forum. 

Another trend expected since the beginning of the conflict was targeted responses to sanction announcements focusing on NATO businesses and governments. Analysts, however, saw the limited reactive actions, with little-to-no direct impact from sanction announcements. Although cyber-attacks on some NATO organizations did take place, they were not as widespread or impactful as expected. Lastly, it was thought that exposure to new and sophisticated exploits would increase and be used to weaken NATO nations - especially corporations in critical industries. However, analysts observed relatively common exploits deployed indiscriminately and opportunistically. Overall, with the wider industry expecting chaos, Darktrace analysts did not see the crisis taken advantage of to target wider businesses outside of Ukraine. Based on this comparison between expectations and reality, the conflict has demonstrated the danger of  falling prey to confirmation bias and the need to remain vigilant and expect the unexpected. It may be possible to say that cyberwar is ‘cold’ right now, however the element of surprise is always present, and it is better to be prepared to protect yourself and your organization.    

What to Expect from the Future

As cyberattacks continue to become less monetarily and physically costly, it is to be expected that they will increase in frequency. Even after a political ceasefire is established, hacking groups can harbour resentment and continue their attacks, though possibly on a smaller scale.  

Additionally, the longer this conflict continues, the more sophisticated hacking groups’s attacks may become. In one of their publications, Killnet shared with subscribers that they had created ‘network weaponry’ powerful enough to simultaneously take down five European countries (Figure 4) [20]. Whether or not this claim is true, it is vital to be prepared. The European Union and the United States have supported Ukraine since the start of the invasion, and the EU has also stated that it is considering providing further assistance to help Ukraine in cyberspace [21].

Figure 4- Snapshot of Killnet Telegram announcement

How to Protect Against these Attacks

In the face of wider conflict and cybersecurity tensions, it is crucial that organizations evaluate their security stack and practise the following: 

·       Know what your critical assets are and what software is running on them. 

·       Keep your software up to date. Prioritize patching critical and high vulnerabilities that allow remote code execution. 

·       Enforce Multifactor Authentication (MFA) to the greatest extent possible. 

·       Require the use of a password manager to generate strong and unique passwords for each separate account. 

·       Backup all the essential files on the cloud and external drives and regularly maintain them. 

·       Train your employees to recognize phishing emails, suspicious websites, infected links or other abnormalities to prevent successful compromise of email accounts. 

In order to prevent an organization from suffering damage due to one of the attacks mentioned above, a full-circle approach is needed. This defence starts with a thorough understanding of the attack surface to provide timely mitigation. This can be supported by Darktrace products: 

·       As shown throughout this blog, Darktrace DETECT and Darktrace/Email have several models relating to conflict-associated TTPs and attacks. These help to quickly alert security teams and provide visibility of anomalous behaviors.

·       Darktrace PREVENT/ASM helps to identify vulnerable external-facing assets. By patching and securing these devices, the risk of exploit is drastically reduced.

·       Darktrace RESPOND and RESPOND/Email can make targeted actions to a range of threats such as blocking incoming DDoS connections or locking malicious email links.

Thanks to the Darktrace Threat Intelligence Unit for their contributions to this blog.

Appendices 

Reference List

[1] https://www.atlanticcouncil.org/blogs/ukrainealert/vladimir-putins-ukraine-invasion-is-the-worlds-first-full-scale-cyberwar/ 

[2] https://www.reuters.com/article/us-ukraine-cybersecurity-idUSKCN0VY30K

[3] https://www.reuters.com/article/us-ukraine-cybersecurity-sandworm-idUSKBN0UM00N20160108

[4 & 11] https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ 

[5] https://www.scmagazine.com/analysis/ransomware/despite-hopes-for-decline-ransomware-attacks-increased-during-russia-ukraine-conflict

[6] https://ransomware.org/blog/has-the-ukraine-conflict-disrupted-ransomware-attacks/

[7] https://www.cfr.org/blog/financial-incentives-may-explain-perceived-lack-ransomware-russias-latest-assault-ukraine

[8] https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/ 

[9] https://voi.id/en/technology/138937/hermetica-owner-from-cyprus-didnt-know-his-server-was-used-in-malicious-malware-attack-in-ukraine 

[10] https://www.reuters.com/article/ukraine-crisis-cyber-cyprus-idCAKBN2KT2QI 

[11] https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-ukraine-hit-by-destructive-attacks-before-and-during-the-russian-invasion-with-hermet/ 

[12] https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/ 

[13] https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ 

[15] https://www.cisa.gov/uscert/ncas/alerts/aa22-057a 

[16] https://attack.mitre.org/groups/G0047/ 

[17] https://cyware.com/news/ukraine-cert-warns-of-increasing-attacks-by-armageddon-group-850081f8 

[18] https://www.bbc.co.uk/news/business-60521822

[19] https://foreignpolicy.com/2022/04/11/russia-cyberwarfare-us-ukraine-volunteer-hackers-it-army/

[20] https://t.me/itarmyofukraine2022

[21] https://www.csoonline.com/article/3664859/russian-ddos-attack-on-lithuania-was-planned-on-telegram-flashpoint-says.html

[19 & 20] https://flashpoint.io/blog/killnet-kaliningrad-and-lithuanias-transport-standoff-with-russia/ 

[21] https://presidence-francaise.consilium.europa.eu/en/news/member-states-united-in-supporting-ukraine-and-strengthening-the-eu-s-telecommunications-and-cybersecurity-resilience/ 

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Rosa Jong
OSINT Analyst
Taisiia Garkava
Security Analyst
Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

AI

/

March 18, 2025

Survey findings: How is AI Impacting the SOC?

Default blog imageDefault blog image

There’s no question that AI is already impacting the SOC – augmenting, assisting, and filling the gaps left by staff and skills shortages. We surveyed over 1,500 cybersecurity professionals from around the world to uncover their attitudes to AI cybersecurity in 2025. Our findings revealed striking trends in how AI is changing the way security leaders think about hiring and SOC transformation. Download the full report for the big picture, available now.

Download the full report to explore these findings in depth

The AI-human conundrum

Let’s start with some context. As the cybersecurity sector has rapidly evolved to integrate AI into all elements of cyber defense, the pace of technological advancement is outstripping the development of necessary skills. Given the ongoing challenges in security operations, such as employee burnout, high turnover rates, and talent shortages, recruiting personnel to bridge these skills gaps remains an immense challenge in today’s landscape.

But here, our main findings on this topic seem to contradict each other.

There’s no question over the impact of AI-powered threats – nearly three-quarters (74%) agree that AI-powered threats now pose a significant challenge for their organization.  

When we look at how security leaders are defending against AI-powered threats, over 3 out of 5 (62%) see insufficient personnel to manage tools and alerts as the biggest barrier.  

Yet at the same time, increasing cyber security staff is at the bottom of the priority list for survey participants, with only 11% planning to increase cybersecurity staff in 2025 – less than in 2024. What 64% of stakeholders are committed to, however, is adding new AI-powered tools onto their existing security stacks.

The conclusion? Due to pressures around hiring, defensive AI is becoming integral to the SOC as a means of augmenting understaffed teams.

How is AI plugging skills shortages in the SOC?

As explored in our recent white paper, the CISO’s Guide to Navigating the Cybersecurity Skills Shortage, 71% of organizations report unfilled cybersecurity positions, leading to the estimation that less than 10% of alerts are thoroughly vetted. In this scenario, AI has become an essential multiplier to relieve the burden on security teams.

95% of respondents agree that AI-powered solutions can significantly improve the speed and efficiency of their defenses. But how?

The area security leaders expect defensive AI to have the biggest impact is on improving threat detection, followed by autonomous response to threats and identifying exploitable vulnerabilities.

Interestingly, the areas that participants ranked less highly (reducing alert fatigue and running phishing simulation), are the tasks that AI already does well and can therefore be used already to relieve the burden of manual, repetitive work on the SOC.

Different perspectives from different sides of the SOC

CISOs and SecOps teams aren’t necessarily aligned on the AI defense question – while CISOs tend to see it as a strategic game-changer, SecOps teams on the front lines may be more sceptical, wary of its real-world reliability and integration into workflows.  

From the data, we see that while less than a quarter of execs doubt that AI-powered solutions will block and automatically respond to AI threats, about half of SecOps aren’t convinced. And only 17% of CISOs lack confidence in the ability of their teams to implement and use AI-powered solutions, whereas over 40% those in the team doubt their own ability to do so.

This gap feeds into the enthusiasm that executives share about adding AI-driven tools into the stack, while day-to-day users of the tools are more interested in improving security awareness training and improving cybersecurity tool integration.

Levels of AI understanding in the SOC

AI is only as powerful as the people who use it, and levels of AI expertise in the SOC can make or break its real-world impact. If security leaders want to unlock AI’s full potential, they must bridge the knowledge gap—ensuring teams understand not just the different types of AI, but where it can be applied for maximum value.

Only 42% of security professionals are confident that they fully understand all the types of AI in their organization’s security stack.

This data varies between job roles – executives report higher levels of understanding (60% say they know exactly which types of AI are being used) than participants in other roles. Despite having a working knowledge of using the tools day-to-day, SecOps practitioners were more likely to report having a “reasonable understanding” of the types of AI in use in their organization (42%).  

Whether this reflects a general confidence in executives rather than technical proficiency it’s hard to say, but it speaks to the importance of AI-human collaboration – introducing AI tools for cybersecurity to plug the gaps in human teams will only be effective if security professionals are supported with the correct education and training.  

Download the full report to explore these findings in depth

The full report for Darktrace’s State of AI Cybersecurity is out now. Download the paper to dig deeper into these trends, and see how results differ by industry, region, organization size, and job title.  

Continue reading
About the author
The Darktrace Community

Blog

/

Network

/

March 18, 2025

Darktrace's Detection of State-Linked ShadowPad Malware

Default blog imageDefault blog image

An integral part of cybersecurity is anomaly detection, which involves identifying unusual patterns or behaviors in network traffic that could indicate malicious activity, such as a cyber-based intrusion. However, attribution remains one of the ever present challenges in cybersecurity. Attribution involves the process of accurately identifying and tracing the source to a specific threat actor(s).

Given the complexity of digital networks and the sophistication of attackers who often use proxies or other methods to disguise their origin, pinpointing the exact source of a cyberattack is an arduous task. Threat actors can use proxy servers, botnets, sophisticated techniques, false flags, etc. Darktrace’s strategy is rooted in the belief that identifying behavioral anomalies is crucial for identifying both known and novel threat actor campaigns.

The ShadowPad cluster

Between July 2024 and November 2024, Darktrace observed a cluster of activity threads sharing notable similarities. The threads began with a malicious actor using compromised user credentials to log in to the target organization's Check Point Remote Access virtual private network (VPN) from an attacker-controlled, remote device named 'DESKTOP-O82ILGG'.  In one case, the IP from which the initial login was carried out was observed to be the ExpressVPN IP address, 194.5.83[.]25. After logging in, the actor gained access to service account credentials, likely via exploitation of an information disclosure vulnerability affecting Check Point Security Gateway devices. Recent reporting suggests this could represent exploitation of CVE-2024-24919 [27,28]. The actor then used these compromised service account credentials to move laterally over RDP and SMB, with files related to the modular backdoor, ShadowPad, being delivered to the  ‘C:\PerfLogs\’ directory of targeted internal systems. ShadowPad was seen communicating with its command-and-control (C2) infrastructure, 158.247.199[.]185 (dscriy.chtq[.]net), via both HTTPS traffic and DNS tunneling, with subdomains of the domain ‘cybaq.chtq[.]net’ being used in the compromised devices’ TXT DNS queries.

Darktrace’s Advanced Search data showing the VPN-connected device initiating RDP connections to a domain controller (DC). The device subsequently distributes likely ShadowPad-related payloads and makes DRSGetNCChanges requests to a second DC.
Figure 1: Darktrace’s Advanced Search data showing the VPN-connected device initiating RDP connections to a domain controller (DC). The device subsequently distributes likely ShadowPad-related payloads and makes DRSGetNCChanges requests to a second DC.
Event Log data showing a DC making DNS queries for subdomains of ‘cbaq.chtq[.]net’ to 158.247.199[.]185 after receiving SMB and RDP connections from the VPN-connected device, DESKTOP-O82ILGG.
Figure 2: Event Log data showing a DC making DNS queries for subdomains of ‘cbaq.chtq[.]net’ to 158.247.199[.]185 after receiving SMB and RDP connections from the VPN-connected device, DESKTOP-O82ILGG.

Darktrace observed these ShadowPad activity threads within the networks of European-based customers in the manufacturing and financial sectors.  One of these intrusions was followed a few months later by likely state-sponsored espionage activity, as detailed in the investigation of the year in Darktrace’s Annual Threat Report 2024.

Related ShadowPad activity

Additional cases of ShadowPad were observed across Darktrace’s customer base in 2024. In some cases, common C2 infrastructure with the cluster discussed above was observed, with dscriy.chtq[.]net and cybaq.chtq[.]net both involved; however, no other common features were identified. These ShadowPad infections were observed between April and November 2024, with customers across multiple regions and sectors affected.  Darktrace’s observations align with multiple other public reports that fit the timeframe of this campaign.

Darktrace has also observed other cases of ShadowPad without common infrastructure since September 2024, suggesting the use of this tool by additional threat actors.

The data theft thread

One of the Darktrace customers impacted by the ShadowPad cluster highlighted above was a European manufacturer. A distinct thread of activity occurred within this organization’s network several months after the ShadowPad intrusion, in October 2024.

The thread involved the internal distribution of highly masqueraded executable files via Sever Message Block (SMB) and WMI (Windows Management Instrumentation), the targeted collection of sensitive information from an internal server, and the exfiltration of collected information to a web of likely compromised sites. This observed thread of activity, therefore, consisted of three phrases: lateral movement, collection, and exfiltration.

The lateral movement phase began when an internal user device used an administrative credential to distribute files named ‘ProgramData\Oracle\java.log’ and 'ProgramData\Oracle\duxwfnfo' to the c$ share on another internal system.  

Darktrace model alert highlighting an SMB write of a file named ‘ProgramData\Oracle\java.log’ to the c$ share on another device.
Figure 3: Darktrace model alert highlighting an SMB write of a file named ‘ProgramData\Oracle\java.log’ to the c$ share on another device.

Over the next few days, Darktrace detected several other internal systems using administrative credentials to upload files with the following names to the c$ share on internal systems:

ProgramData\Adobe\ARM\webservices.dll

ProgramData\Adobe\ARM\wksprt.exe

ProgramData\Oracle\Java\wksprt.exe

ProgramData\Oracle\Java\webservices.dll

ProgramData\Microsoft\DRM\wksprt.exe

ProgramData\Microsoft\DRM\webservices.dll

ProgramData\Abletech\Client\webservices.dll

ProgramData\Abletech\Client\client.exe

ProgramData\Adobe\ARM\rzrmxrwfvp

ProgramData\3Dconnexion\3DxWare\3DxWare.exe

ProgramData\3Dconnexion\3DxWare\webservices.dll

ProgramData\IDMComp\UltraCompare\updater.exe

ProgramData\IDMComp\UltraCompare\webservices.dll

ProgramData\IDMComp\UltraCompare\imtrqjsaqmm

Cyber AI Analyst highlighting an SMB write of a file named ‘ProgramData\Adobe\ARM\webservices.dll’ to the c$ share on an internal system.
Figure 4: Cyber AI Analyst highlighting an SMB write of a file named ‘ProgramData\Adobe\ARM\webservices.dll’ to the c$ share on an internal system.

The threat actor appears to have abused the Microsoft RPC (MS-RPC) service, WMI, to execute distributed payloads, as evidenced by the ExecMethod requests to the IWbemServices RPC interface which immediately followed devices’ SMB uploads.  

Cyber AI Analyst data highlighting a thread of activity starting with an SMB data upload followed by ExecMethod requests.
Figure 5: Cyber AI Analyst data highlighting a thread of activity starting with an SMB data upload followed by ExecMethod requests.

Several of the devices involved in these lateral movement activities, both on the source and destination side, were subsequently seen using administrative credentials to download tens of GBs of sensitive data over SMB from a specially selected server.  The data gathering stage of the threat sequence indicates that the threat actor had a comprehensive understanding of the organization’s system architecture and had precise objectives for the information they sought to extract.

Immediately after collecting data from the targeted server, devices went on to exfiltrate stolen data to multiple sites. Several other likely compromised sites appear to have been used as general C2 infrastructure for this intrusion activity. The sites used by the threat actor for C2 and data exfiltration purport to be sites for companies offering a variety of service, ranging from consultancy to web design.

Screenshot of one of the likely compromised sites used in the intrusion. 
Figure 6: Screenshot of one of the likely compromised sites used in the intrusion.

At least 16 sites were identified as being likely data exfiltration or C2 sites used by this threat actor in their operation against this organization. The fact that the actor had such a wide web of compromised sites at their disposal suggests that they were well-resourced and highly prepared.  

Darktrace model alert highlighting an internal device slowly exfiltrating data to the external endpoint, yasuconsulting[.]com.
Figure 7: Darktrace model alert highlighting an internal device slowly exfiltrating data to the external endpoint, yasuconsulting[.]com.
Darktrace model alert highlighting an internal device downloading nearly 1 GB of data from an internal system just before uploading a similar volume of data to another suspicious endpoint, www.tunemmuhendislik[.]com    
Figure 8: Darktrace model alert highlighting an internal device downloading nearly 1 GB of data from an internal system just before uploading a similar volume of data to another suspicious endpoint, www.tunemmuhendislik[.]com  

Cyber AI Analyst spotlight

Cyber AI Analyst identifying and piecing together the various steps of a ShadowPad intrusion.
Figure 9: Cyber AI Analyst identifying and piecing together the various steps of a ShadowPad intrusion.  
Cyber AI Analyst Incident identifying and piecing together the various steps of the data theft activity.
Figure 10: Cyber AI Analyst Incident identifying and piecing together the various steps of the data theft activity.

As shown in the above figures, Cyber AI Analyst’s ability to thread together the different steps of these attack chains are worth highlighting.

In the ShadowPad attack chains, Cyber AI Analyst was able to identify SMB writes from the VPN subnet to the DC, and the C2 connections from the DC. It was also able to weave together this activity into a single thread representing the attacker’s progression.

Similarly, in the data exfiltration attack chain, Cyber AI Analyst identified and connected multiple types of lateral movement over SMB and WMI and external C2 communication to various external endpoints, linking them in a single, connected incident.

These Cyber AI Analyst actions enabled a quicker understanding of the threat actor sequence of events and, in some cases, faster containment.

Attribution puzzle

Publicly shared research into ShadowPad indicates that it is predominantly used as a backdoor in People’s Republic of China (PRC)-sponsored espionage operations [5][6][7][8][9][10]. Most publicly reported intrusions involving ShadowPad  are attributed to the China-based threat actor, APT41 [11][12]. Furthermore, Google Threat Intelligence Group (GTIG) recently shared their assessment that ShadowPad usage is restricted to clusters associated with APT41 [13]. Interestingly, however, there have also been public reports of ShadowPad usage in unattributed intrusions [5].

The data theft activity that later occurred in the same Darktrace customer network as one of these ShadowPad compromises appeared to be the targeted collection and exfiltration of sensitive data. Such an objective indicates the activity may have been part of a state-sponsored operation. The tactics, techniques, and procedures (TTPs), artifacts, and C2 infrastructure observed in the data theft thread appear to resemble activity seen in previous Democratic People’s Republic of Korea (DPRK)-linked intrusion activities [15] [16] [17] [18] [19].

The distribution of payloads to the following directory locations appears to be a relatively common behavior in DPRK-sponsored intrusions.

Observed examples:

C:\ProgramData\Oracle\Java\  

C:\ProgramData\Adobe\ARM\  

C:\ProgramData\Microsoft\DRM\  

C:\ProgramData\Abletech\Client\  

C:\ProgramData\IDMComp\UltraCompare\  

C:\ProgramData\3Dconnexion\3DxWare\

Additionally, the likely compromised websites observed in the data theft thread, along with some of the target URI patterns seen in the C2 communications to these sites, resemble those seen in previously reported DPRK-linked intrusion activities.

No clear evidence was found to link the ShadowPad compromise to the subsequent data theft activity that was observed on the network of the manufacturing customer. It should be noted, however, that no clear signs of initial access were found for the data theft thread – this could suggest the ShadowPad intrusion itself represents the initial point of entry that ultimately led to data exfiltration.

Motivation-wise, it seems plausible for the data theft thread to have been part of a DPRK-sponsored operation. DPRK is known to pursue targets that could potentially fulfil its national security goals and had been publicly reported as being active in months prior to this intrusion [21]. Furthermore, the timing of the data theft aligns with the ratification of the mutual defense treaty between DPRK and Russia and the subsequent accused activities [20].

Darktrace assesses with medium confidence that a nation-state, likely DPRK, was responsible, based on our investigation, the threat actor applied resources, patience, obfuscation, and evasiveness combined with external reporting, collaboration with the cyber community, assessing the attacker’s motivation and world geopolitical timeline, and undisclosed intelligence.

Conclusion

When state-linked cyber activity occurs within an organization’s environment, previously unseen C2 infrastructure and advanced evasion techniques will likely be used. State-linked cyber actors, through their resources and patience, are able to bypass most detection methods, leaving anomaly-based methods as a last line of defense.

Two threads of activity were observed within Darktrace’s customer base over the last year: The first operation involved the abuse of Check Point VPN credentials to log in remotely to organizations’ networks, followed by the distribution of ShadowPad to an internal domain controller. The second operation involved highly targeted data exfiltration from the network of one of the customers impacted by the previously mentioned ShadowPad activity.

Despite definitive attribution remaining unresolved, both the ShadowPad and data exfiltration activities were detected by Darktrace’s Self-Learning AI, with Cyber AI Analyst playing a significant role in identifying and piecing together the various steps of the intrusion activities.  

Credit to Sam Lister (R&D Detection Analyst), Emma Foulger (Principal Cyber Analyst), Nathaniel Jones (VP), and the Darktrace Threat Research team.

Appendices

Darktrace / NETWORK model alerts

User / New Admin Credentials on Client

Anomalous Connection / Unusual Admin SMB Session

Compliance / SMB Drive Write  

Device / Anomalous SMB Followed By Multiple Model Breaches

Anomalous File / Internal / Unusual SMB Script Write

User / New Admin Credentials on Client  

Anomalous Connection / Unusual Admin SMB Session

Compliance / SMB Drive Write

Device / Anomalous SMB Followed By Multiple Model Breaches

Anomalous File / Internal / Unusual SMB Script Write

Device / New or Uncommon WMI Activity

Unusual Activity / Internal Data Transfer

Anomalous Connection / Download and Upload

Anomalous Server Activity / Rare External from Server

Compromise / Beacon to Young Endpoint

Compromise / Agent Beacon (Short Period)

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Connection / POST to PHP on New External Host

Compromise / Sustained SSL or HTTP Increase

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Anomalous Connection / Multiple Failed Connections to Rare Endpoint

Device / Multiple C2 Model Alerts

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / Download and Upload

Unusual Activity / Unusual External Data Transfer

Anomalous Connection / Low and Slow Exfiltration

Anomalous Connection / Uncommon 1 GiB Outbound  

MITRE ATT&CK mapping

(Technique name – Tactic ID)

ShadowPad malware threads

Initial Access - Valid Accounts: Domain Accounts (T1078.002)

Initial Access - External Remote Services (T1133)

Privilege Escalation - Exploitation for Privilege Escalation (T1068)

Privilege Escalation - Valid Accounts: Default Accounts (T1078.001)

Defense Evasion - Masquerading: Match Legitimate Name or Location (T1036.005)

Lateral Movement - Remote Services: Remote Desktop Protocol (T1021.001)

Lateral Movement - Remote Services: SMB/Windows Admin Shares (T1021.002)

Command and Control - Proxy: Internal Proxy (T1090.001)

Command and Control - Application Layer Protocol: Web Protocols (T1071.001)

Command and Control - Encrypted Channel: Asymmetric Cryptography (T1573.002)

Command and Control - Application Layer Protocol: DNS (T1071.004)

Data theft thread

Resource Development - Compromise Infrastructure: Domains (T1584.001)

Privilege Escalation - Valid Accounts: Default Accounts (T1078.001)

Privilege Escalation - Valid Accounts: Domain Accounts (T1078.002)

Execution - Windows Management Instrumentation (T1047)

Defense Evasion - Masquerading: Match Legitimate Name or Location (T1036.005)

Defense Evasion - Obfuscated Files or Information (T1027)

Lateral Movement - Remote Services: SMB/Windows Admin Shares (T1021.002)

Collection - Data from Network Shared Drive (T1039)

Command and Control - Application Layer Protocol: Web Protocols (T1071.001)

Command and Control - Encrypted Channel: Asymmetric Cryptography (T1573.002)

Command and Control - Proxy: External Proxy (T1090.002)

Exfiltration - Exfiltration Over C2 Channel (T1041)

Exfiltration - Data Transfer Size Limits (T1030)

List of indicators of compromise (IoCs)

IP addresses and/or domain names (Mid-high confidence):

ShadowPad thread

- dscriy.chtq[.]net • 158.247.199[.]185 (endpoint of C2 comms)

- cybaq.chtq[.]net (domain name used for DNS tunneling)  

Data theft thread

- yasuconsulting[.]com (45.158.12[.]7)

- hobivan[.]net (94.73.151[.]72)

- mediostresbarbas.com[.]ar (75.102.23[.]3)

- mnmathleague[.]org (185.148.129[.]24)

- goldenborek[.]com (94.138.200[.]40)

- tunemmuhendislik[.]com (94.199.206[.]45)

- anvil.org[.]ph (67.209.121[.]137)

- partnerls[.]pl (5.187.53[.]50)

- angoramedikal[.]com (89.19.29[.]128)

- awork-designs[.]dk (78.46.20[.]225)

- digitweco[.]com (38.54.95[.]190)

- duepunti-studio[.]it (89.46.106[.]61)

- scgestor.com[.]br (108.181.92[.]71)

- lacapannadelsilenzio[.]it (86.107.36[.]15)

- lovetamagotchith[.]com (203.170.190[.]137)

- lieta[.]it (78.46.146[.]147)

File names (Mid-high confidence):

ShadowPad thread:

- perflogs\1.txt

- perflogs\AppLaunch.exe

- perflogs\F4A3E8BE.tmp

- perflogs\mscoree.dll

Data theft thread

- ProgramData\Oracle\java.log

- ProgramData\Oracle\duxwfnfo

- ProgramData\Adobe\ARM\webservices.dll

- ProgramData\Adobe\ARM\wksprt.exe

- ProgramData\Oracle\Java\wksprt.exe

- ProgramData\Oracle\Java\webservices.dll

- ProgramData\Microsoft\DRM\wksprt.exe

- ProgramData\Microsoft\DRM\webservices.dll

- ProgramData\Abletech\Client\webservices.dll

- ProgramData\Abletech\Client\client.exe

- ProgramData\Adobe\ARM\rzrmxrwfvp

- ProgramData\3Dconnexion\3DxWare\3DxWare.exe

- ProgramData\3Dconnexion\3DxWare\webservices.dll

- ProgramData\IDMComp\UltraCompare\updater.exe

- ProgramData\IDMComp\UltraCompare\webservices.dll

- ProgramData\IDMComp\UltraCompare\imtrqjsaqmm

- temp\HousecallLauncher64.exe

Attacker-controlled device hostname (Mid-high confidence)

- DESKTOP-O82ILGG

References  

[1] https://www.kaspersky.com/about/press-releases/shadowpad-how-attackers-hide-backdoor-in-software-used-by-hundreds-of-large-companies-around-the-world  

[2] https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf

[3] https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities

[4] https://securelist.com/operation-shadowhammer-a-high-profile-supply-chain-attack/90380/

[5] https://assets.sentinelone.com/c/Shadowpad?x=P42eqA

[6] https://www.cyfirma.com/research/the-origins-of-apt-41-and-shadowpad-lineage/

[7] https://www.csoonline.com/article/572061/shadowpad-has-become-the-rat-of-choice-for-several-state-sponsored-chinese-apts.html

[8] https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/shadowpad-new-activity-from-the-winnti-group

[9] https://cymulate.com/threats/shadowpad-privately-sold-malware-espionage-tool/

[10] https://www.secureworks.com/research/shadowpad-malware-analysis

[11] https://blog.talosintelligence.com/chinese-hacking-group-apt41-compromised-taiwanese-government-affiliated-research-institute-with-shadowpad-and-cobaltstrike-2/

[12] https://hackerseye.net/all-blog-items/tails-from-the-shadow-apt-41-injecting-shadowpad-with-sideloading/

[13] https://cloud.google.com/blog/topics/threat-intelligence/scatterbrain-unmasking-poisonplug-obfuscator

[14] https://www.domaintools.com/wp-content/uploads/conceptualizing-a-continuum-of-cyber-threat-attribution.pdf

[15] https://www.nccgroup.com/es/research-blog/north-korea-s-lazarus-their-initial-access-trade-craft-using-social-media-and-social-engineering/  

[16] https://www.microsoft.com/en-us/security/blog/2021/01/28/zinc-attacks-against-security-researchers/

[17] https://www.microsoft.com/en-us/security/blog/2022/09/29/zinc-weaponizing-open-source-software/  

[18] https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/  

[19] https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html  

[20] https://usun.usmission.gov/joint-statement-on-the-unlawful-arms-transfer-by-the-democratic-peoples-republic-of-korea-to-russia/

[21] https://media.defense.gov/2024/Jul/25/2003510137/-1/-1/1/Joint-CSA-North-Korea-Cyber-Espionage-Advance-Military-Nuclear-Programs.PDF  

[22] https://kyivindependent.com/first-north-korean-troops-deployed-to-front-line-in-kursk-oblast-ukraines-military-intelligence-says/

[23] https://www.microsoft.com/en-us/security/blog/2024/12/04/frequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage/  

[24] https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/  

[25] https://www.sentinelone.com/labs/chamelgang-attacking-critical-infrastructure-with-ransomware/    

[26] https://thehackernews.com/2022/06/state-backed-hackers-using-ransomware.html/  

[27] https://blog.checkpoint.com/security/check-point-research-explains-shadow-pad-nailaolocker-and-its-protection/

[28] https://www.orangecyberdefense.com/global/blog/cert-news/meet-nailaolocker-a-ransomware-distributed-in-europe-by-shadowpad-and-plugx-backdoors

Continue reading
About the author
Sam Lister
SOC Analyst
Your data. Our AI.
Elevate your network security with Darktrace AI