Cyberattack by group APT28 using malicious program CredoMap_v2 (CERT-UA#4622)

Summary

APT28 ran a phishing operation that delivered a password-protected RAR archive named UkrScanner.rar. Inside the archive was a self-extracting (SFX) executable that installed CredoMap_v2. The malware steals and exfiltrates credentials via HTTP POST to attacker-controlled infrastructure hosted on the Pipedream platform. The incident was disclosed by CERT-UA (Ukraine’s national CERT).

Investigation

CERT-UA received a suspicious message impersonating its own organization and carrying the password-protected RAR attachment. Examination of the SFX payload revealed the CredoMap_v2 binary and its HTTP-based credential exfiltration routine. Analysts traced outbound traffic to eo2mxtqmeqzafqi.m.pipedream.net and 69.16.243.33. Based on the tooling and infrastructure, the activity was attributed to the known APT28 threat group.

Mitigation

CERT-UA blocked the malicious Pipedream domain and the associated IP address. Users were advised to treat password-protected archives as high-risk and to validate sender identity through trusted channels. Prevent execution of unknown executables using OS controls and endpoint security policies.

Response

Train users to spot phishing and confirm senders, especially when attachments are password protected. Strengthen email filtering for suspicious archives and executables and block known hostile infrastructure. Monitor outbound HTTP traffic for unexpected POST requests to untrusted domains and investigate any matches promptly.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  An APT28 operator receives a phishing email containing a password‑protected RAR archive. Inside, there is a self‑extracting (SFX) executable named UkrScanner.exe. After extracting the archive on the victim machine, the operator runs the SFX stub, which drops and executes the CredoMap_v2 malware. The execution of UkrScanner.exe creates a process creation event that matches the detection rule.

  Simulation steps (performed on the test host):

  1. Create a dummy executable named UkrScanner.exe (copy of powershell.exe for safety).
  2. Launch the dummy executable to mimic the attacker’s execution of the SFX file.

• Regression Test Script:

  # ==============================
  # Simulation of CredoMap_v2 execution from SFX (UkrScanner.exe)
  # ==============================
  $tempPath = "$env:TEMPUkrScanner.exe"
  
  # 1. Prepare a harmless stand‑in payload (copy of powershell.exe)
  Copy-Item -Path "$env:SystemRootSystem32WindowsPowerShellv1.0powershell.exe" -Destination $tempPath -Force
  
  # 2. Ensure the file is executable
  Unblock-File -Path $tempPath
  
  # 3. Execute the dummy SFX stub (simulates attacker running the file)
  Write-Host "Launching dummy SFX executable..."
  Start-Process -FilePath $tempPath -ArgumentList "-NoProfile -WindowStyle Hidden" -PassThru
  
  # 4. Pause to allow SIEM ingestion
  Start-Sleep -Seconds 5
  Write-Host "Simulation complete. Check SIEM for a detection of process creation ending with 'UkrScanner.exe'."

• Cleanup Commands:

  # Stop any lingering powershell processes started by the dummy executable (if any)
  Get-Process -Name "powershell" -ErrorAction SilentlyContinue | Where-Object {$_.Path -like "*UkrScanner.exe"} | Stop-Process -Force
  
  # Remove the dummy executable
  $tempPath = "$env:TEMPUkrScanner.exe"
  if (Test-Path $tempPath) {
      Remove-Item -Path $tempPath -Force
      Write-Host "Cleanup complete: removed $tempPath"
  }