ESET Telebots Dec 2016

Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.

KillDisk registers as a service under the Plug-And-Play Support name.

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.

Sandworm Team has used intercepter-NG to sniff passwords in network traffic.

Sandworm Team has sent system information to its C2 server using HTTP.

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.

Sandworm Team has created VBScripts to run an SSH server.

KillDisk has the ability to quit and delete itself.

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.

Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.