Activity-masking infostealer dropper | Kaspersky official blog
Source Kaspersky Security Blog
Description
Malware disguising its activity in network and system logs as legitimate state information system traffic and a Network Diagnostic Service.
Impact
For European organizations, the primary impact lies in the potential for data theft, including sensitive documents and system information, which could lead to intellectual property loss, espionage, or competitive disadvantage. The malware’s stealthy behavior and use of legitimate-looking network traffic increase the risk of prolonged undetected presence, enabling attackers to conduct extended reconnaissance or prepare for more damaging attacks such as ransomware deployment. The flexible payload delivery mechanism means that even if the current campaign is limited to infostealing, future variants could escalate to destructive attacks impacting availability and integrity of systems. Organizations with cross-border operations or partnerships with Russian entities may face increased exposure. Additionally, the use of social engineering in Russian language and targeting of Russian private sector suggests a potential spillover risk to European companies with Russian-speaking employees or business ties. Incident response efforts may be hindered due to the malware’s activity masking, increasing remediation costs and operational disruption.
Defensive guidance
European organizations should implement multi-layered defenses tailored to detect and block this threat’s specific tactics. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying .NET-based downloaders and suspicious service installations, especially those masquerading as network diagnostic tools. Network monitoring should include anomaly detection to identify traffic to domains visually similar to legitimate government portals, and inspect HTTP headers for unusual AuthKey values. Email security gateways must be configured to detect and quarantine emails with executable attachments disguised as documents, employing sandboxing to analyze attachment behavior. User awareness training should emphasize the risks of opening unexpected attachments, particularly those with enticing filenames related to official proceedings or payments. Restrict execution of files from user directories and enforce application whitelisting to prevent unauthorized service installations. Regularly audit and monitor the C:\ProgramData\Microsoft Diagnostic\Tasks directory for unauthorized files. Incident response plans should include procedures for identifying and eradicating persistent services named similarly to legitimate system tools. Finally, maintain up-to-date threat intelligence feeds and integrate them into security operations to detect emerging variants or related campaigns.