Secret Blizzard Deploys Kazuar Backdoor in Ukraine Using Amadey Malware-as-a-Service

Attribute	Details
Threat Actors	Secret Blizzard (also known as Turla)
Campaign Overview	Secret Blizzard leveraging other threat actors’ infrastructure to deploy Kazuar backdoor in Ukraine.
Target Regions/Victims	Ukrainian military and defense-related entities.
Methodology	Adversary-in-the-middle (AitM), strategic web compromises (watering hole attacks), spear-phishing.
Product Targeted	Kazuar backdoor, Tavdig backdoor, Amadey bot.
Malware Reference	KazuarV2, Tavdig, Amadey.
Tools Used	Amadey Malware-as-a-Service, COOKBOX (PowerShell backdoor).
Vulnerabilities Exploited	Amadey C2 panels, DLL side-loading vulnerability.
TTPs	Reconnaissance, C2 communications, obfuscation (Base64 encoding), DLL side-loading, stealth deployment.
Attribution	Secret Blizzard, linked with Turla, operational ties to Flying Yeti (Storm-1837).
Recommendations	Strengthen C2 server monitoring, implement robust endpoint detection, isolate critical infrastructure components.
Source	The Hackers News

Read full article: https://thehackernews.com/2024/12/secret-blizzard-deploys-kazuar-backdoor.html

The above summary has been generated by an AI language model