A new information-stealing malware was seen being used by a threat actor with ties to Russia in cyberattacks directed against Ukraine. The malware, nicknamed Graphiron by Broadcom-owned Symantec, was created by the Nodaria espionage organization and is registered as UAC-0056 by the Computer Emergency Response Team of Ukraine (CERT-UA).
“The malware is written in Go and is designed to harvest a wide range of information from the infected computer, including system information, credentials, screenshots, and files,” the Symantec Threat Hunter Team said in a report.
The use of SaintBot and OutSteel malware by Nodaria in spear-phishing operations against government targets was first revealed by CERT-UA in January 2022. In the wake of Russia’s armed invasion of Ukraine, the gang, which has been operating at least since April 2021, has frequently used custom backdoors like GraphSteel and GrimPlant in a variety of activities. In certain incursions, Cobalt Strike Beacon was also sent for post-exploitation.
The most recent tool in the group’s toolbox, Graphiron, is an enhanced version of GraphSteel that includes functionality to execute shell commands and gather system data, files, passwords, screenshots, and SSH keys. Another noteworthy distinction is that, in contrast to GraphSteel and GrimPlant, which depend on Go version 1.16, Graphiron uses version 1.18, which was released in March 2022. This implies that Graphiron is likewise a relatively new development.
The use of Graphiron was first documented in October 2022, and attacks continued to use it at least through mid-January 2023. Additionally, a review of the infection chains revealed the existence of two phases, including a downloader that is in charge of getting the Graphiron malware from a remote server in an encrypted payload.
With the most recent information, Nodaria joins another state-sponsored Russian organization called Gamaredon in specifically singling out Ukraine. Symantec said that Nodaria was a relatively obscure organization before Russia invaded Ukraine. Still, the group’s high-level activity during the previous year shows that it is now one of the prominent participants in Russia’s continuing cyberattacks against Ukraine.
