An Advanced Persistent Threat (APT) known as CommonMagic has been observed targeting administrative organizations in conflict zones in Russia and Ukraine.
According to an advisory issued today by Kaspersky, CommonMagic has been active since at least September 2021, with the group attacking administrations, agriculture and transportation in Donetsk, Luhansk and Crimea.
“While the initial vector of compromise is unknown, details of subsequent stages suggest the use of spear phishing or similar methods,” read the technical article. “The victim navigated to a URL pointing to a ZIP archive hosted on a malicious web server. The archive contained two files.”
The first of these files is a decoy document (either a PDF, XLSX, or DOC file) and the second is a malicious LNK (Windows shortcut) file with two extensions (e.g. .pdf) .lnk) and caused an infection when opened. .
Learn more about shortcut files here: Are you losing the war against ransomware?
Kaspersky explained that the threat actor used a PowerShell-based backdoor called PowerMagic and a new malicious framework called CommonMagic after the group name to carry out the attack.
“The backdoor receives commands from remote folders located on public cloud storage services, executes commands sent by the server, and uploads the execution results to the cloud,” writes Kaspersky. “PowerMagic sets itself up in the system to be permanently launched when the infected device boots.”
Regarding CommonMagic, security researchers explained that the framework consists of multiple modules. Each is an executable file launched in a separate process and the modules can communicate.
“This framework can steal files from USB devices, take screenshots every 3 seconds, and send them to the attacker,” the advisory reads.
Kaspersky security researcher Leonid Bezvershenko commented on the findings, saying that while the malware and techniques used in the CommonMagic campaign were not particularly sophisticated, cloud storage as a command and control (C2) infrastructure said to be important.
“We hope to continue our research and share more insights about this campaign.”
