#ESETresearch unearths modus operandi of the elusive #InvisiMole group, digging up their arsenal used to stay invisible. Our investigation also shows previously unknown ties between InvisiMole and #Gamaredon groups welivesecurity.com/2020/06/18/dig… @cherepanov74 @zuzana_hromcova 1/9
#InvisiMole #APT group resurfaced in targeted attacks against high-profile organizations in Eastern Europe, targeting military sector and diplomatic missions. We previously documented their two feature-rich backdoors RC2CL and RC2FM; now we reveal the rest of their TTPs. 2/9
We discovered that the most interesting targets of #Gamaredon are upgraded to far stealthier #InvisiMole spyware, with Gamaredon’s .NET downloader delivering InvisiMole’s TCP downloader. This cooperation allows InvisiMole to devise creative ways to operate under the radar. 3/9 
#InvisiMole places execution guardrails on its components to hide from security researchers. Encrypted with #DPAPI, the payload can only be decrypted on the victim’s computer. Luckily, we recovered the payloads thanks to our close cooperation with the affected organizations. 4/9
InvisiMole uses long execution chains for covert execution and long-term persistence. The group exclusively installs #LOLBins and vulnerable executables on the system, and then abuses these legitimate executables to load the malicious shellcode in the later stages. 5/9
The attackers use the Bring Your Own Vulnerable Driver (and Bring Your Own Vulnerable Software) techniques to introduce vulnerable executables to the system. They deliver and exploit the vulnerable #Windows wdigest.dll library, speedfan.sys driver and third-party software. 6/9
The attackers use improved ListPlanting technique for code injection. Instead of calling WriteProcessMemory, #InvisiMole sends LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages to the target SysListView32, with shellcode bytes provided as the new coordinates. 7/9
For a stealthier C&C communication, #InvisiMole builds a custom DNS tunneling protocol on top of the #DNS protocol. The communication is embedded in subdomains, generated by the client for each request, and in DNS AAAA and NULL records from the server. 8/9
The Indicators of Compromise are available on our GitHub repository: github.com/eset/malware-i…
You can read the detailed white paper here: welivesecurity.com/wp-content/upl…
#ESETresearch #InvisiMole 9/9
You can read the detailed white paper here: welivesecurity.com/wp-content/upl…
#ESETresearch #InvisiMole 9/9
