Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets

Key takeaways:

• The Deep Instinct Threat Lab has discovered a new operation against Azerbaijanian targets
• The operation has at least two different initial access vectors
• The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language
• One of the lures used in the operation is a modified document that was used by the Storm-0978 group. This could be a deliberate “false flag”

LNK Vector:

Deep Instinct Threat Lab observed a malicious LNK file with low detections named “1.KARABAKH.jpg.lnk.”

The file has a double extension to lure the victim to click an image that is related to a military incident in Nagorno-Karabakh.

The LNK downloads and executes an MSI installer hosted by DropBox:

The MSI file drops an implant written in Rust, an xml file for a scheduled task to execute the implant, and a decoy image file:

The image file includes watermarks of the symbol of the Azerbaijanian MOD.

Office False Flag Vector:

Once we identified the LNK campaign the Deep Instinct Threat Lab attempted to identify additional, related files.

Deep Instinct Threat Lab quickly found another MSI file hosted on DropBox that drops a different variant of the same Rust implant; however, the identification of the initial access vector for this campaign was trickier.

The DropBox URL was masked with a URL shortener (hxxps://t[.]]ly/8CYQW) and the evidence showed that this URL was invoked via exploitation of Microsoft Equation Editor CVE-2017-11882.

Deep Instinct Threat Lab identified a file named “Overview_of_UWCs_UkraineInNATO_campaign.docx” that was invoking the request to this shortened URL; however, this filename and its content are known to be associated with a Storm-0978 campaign utilizing CVE-2023-36884.

The identified file even had a comment on VirusTotal that it is related to the Storm-0978 campaign:

After further investigation it was revealed that this is a different file, not related to the Storm-0978 campaign. The embedded “afchunk.rtf” file has been replaced and CVE-2023-36884 is not used. Instead, CVE-2017-11882 is used to download and install the MSI file.

This action looks like a deliberate false flag attempt to pin this attack on Storm-0978.

Even though the initial lure is an Office file, the delivered MSI file also open a decoy file, this time a PDF invoice:

MSI Analysis:

While the initial vectors are different, the execution is the same and it is done by invoking msiexec with URL to DropBox.

Using a Linux file command or msitools it seems that the MSI files were created by “MSI Wrapper” https://www.exemsi.com/, which is often used by threat actors to drop malicious files.

The MSI installers are dropping and executing the Rust implant along with a decoy file and xml file for scheduled task.

Rust Implant Analysis:

Each attack had its unique file names and metadata. One of the file Rust Implants named “WinDefenderHealth.exe” is written in Rust. It is expected to gather information and send it to the attacker server, which is still active at the time of this research.

Rust is becoming more popular among malware authors. Security products are not yet detecting Rust malware accurately, and the reverse engineering process is more complex. The Rust standard library is not familiar to tools like IDA and Ghidra. It results in tagging large portions of the code as unknown, and it is difficult to differentiate the code of the standard library from the code of the malware. To overcome this, the plugin GhidRust was used, but it didn't detect the functions of the standard library. In addition, BinDiff was used. A simple Rust binary was compiled and compared against the malware, but very little code was shared. Some open projects for Rust were used in the malware such as Tokio (a runtime for writing reliable, asynchronous, and slim applications with the Rust programming language), hyper (a fast and correct HTTP implementation for Rust) and Serde JSON (a framework for serializing and deserializing Rust data structures efficiently and generically). After that part, we moved on to dynamic analysis.

Once the file is executed it goes to sleep for 12 minutes. This is a known method to avoid security researchers and sandbox’s easy analysis.

Then it starts collecting information about the infected machine:

The malware then reads the output of the above executions by redirecting their StdOut to a named pipe. It is notable that the values of StdIn, StdOut, and StdErr match the handles of the processes to the named pipes.

The information is gathered leveraging the following template:

The above information is then encrypted and sent to the attacker server using an uncommon, hardcoded port 35667:

We have built a script to decrypt the information, available in our Git, that the malware is sending.

All analyzed files above have a low detection rate on VT at the time. There are zero detections on first seen and most of the detections are generic ones.

While the other Rust implant still has zero detections:

Conclusion:

Deep Instinct Threat Lab could not attribute these attacks to any known threat actor. There is a possibility that these files are part of a red team exercise.

Regardless of the above statement, the fact that both Rust implants had zero detections when first uploaded to VirusTotal shows that writing malware in esoteric languages can bypass many security solutions.

MITRE:

IOC:

78.135.73[.]140