A new espionage campaign by the InvisiMole group has led ESET researchers to discover their hidden tools and a strategic collaboration with the Gamaredon group
Researchers from ESET, a global leader in the cybersecurity market, during the analysis of a new attack coming from the InvisiMole group, first reported by ESET in 2018, they discovered the tools used by the organization and other previously unknown details about their modus operandi. The findings derive from an investigation conducted jointly with victims of the attack. In this new campaign, the InvisiMole group has equipped itself with new tools to target high-profile organizations in the military and diplomatic sectors of Eastern Europe. According to ESET telemetry, the cyberattacks occurred from the end of 2019 until the end of June.
InvisiMole, known since 2013, was first documented by ESET in relation to targeted cyberespionage operations in Ukraine and Russia, through the use of two very complex backdoors.
“At the time we identified these very advanced backdoors, but the overall picture was missing: we didn't know how they were inserted into the system,” he explained Zuzana Hromcová, ESET researcher which InvisiMole analyzed.
Thanks to the analysis of the attacks, carried out in collaboration with the affected organizations, ESET analysts had the opportunity to carry out an in-depth investigation of the techniques used by the hackers. “We were able to document the broad set of tools that were used to exploit InvisiMole backdoors,” he said Anton Cherepanov, ESET malware analyst who conducted the investigation.
One of the most important findings of the investigation concerns the collaboration of the InvisiMole group with another group of cybercriminals, Gamaredon. ESET discovered that the latter acts as a trailblazer, infiltrating the victims' network and obtaining administrative privileges before giving way to InvisiMole.
“Our investigation finds that the intended victims were first attacked by a rather common malware such as Gamaredon, which was then taken over by InvisiMole with sophisticated techniques to avoid detection,” added ESET's Hromcová.
To stay out of the reach of control systems, InvisiMole, according to ESET, uses 4 different attack techniques, combining malicious shellcode with authorized tools and vulnerable executable programs. The malware is encoded with a symmetric encryption system directly on the victim's computer, and can only be decrypted and executed on that computer.
The malware also has a communication system that uses DNS tunneling and which allows it to send and receive information without alerting the control systems.
Analyzing the new tools used by the group, analysts found substantial improvements compared to the versions examined previously. “With this new information, we will be able to monitor the group's illicit activities even more effectively,” concluded ESET's Hromcová.
More information on the InvisiMole survey in the white paper "InvisiMole: The hidden part of the story”.
