The HTA file downloads and executes additional malicious components, including:Ī legitimate Microsoft-signed binary named 'sqlwriter.exe' or 'sqldumper.exe', which is vulnerable to DLL side-loading.Ī malicious DLL named 'vcruntime140.dll', crafted by the threat actor to be side-loaded by the legitimate binary. The obfuscation technique used in this code matches patterns associated with the publicly available obfuscator 'obfuscator.io'. Upon executing the HTA file, obfuscated JavaScript code initiates the next stage of the infection chain. The ZIP file contains an HTML Application (HTA) file named 'wine.hta' or 'invite.hta', depending on the sample analyzed. This PDF file, masquerading as an invitation to a wine tasting event, includes a link to a ZIP file hosted on a compromised website. The attack chain begins with a spear-phishing email containing a malicious PDF attachment.

By examining the spear-phishing attachment and the various components of the infection chain, we aim to provide defenders with the knowledge needed to identify and mitigate this threat. This section dives deeper into the TTPs employed by APT29 in the initial access stage of the WINELOADER campaign. By understanding the TTPs and malware employed in this campaign, security teams can enhance their detection capabilities and better protect their organizations from this sophisticated threat. WINELOADER Analysis: We'll dive deep into the WINELOADER backdoor, exploring its capabilities, command and control (C2) communication, and evasion techniques.įurthermore, we'll showcase the Splunk security content developed by the Splunk Threat Research Team to help defenders detect and respond to this threat.Īs APT29 continues to adapt and evolve their tactics, it is crucial for organizations to stay informed and prepared. Initial Access: We'll examine the spear-phishing email, the compromised website hosting the malicious ZIP file, and the HTA file responsible for the initial stages of the infection chain.

This blog post provides a detailed analysis of the tactics, techniques, and procedures (TTPs) employed by APT29 in this campaign, focusing on two key aspects: The ZIP file contains an HTML Application (HTA) file that, when executed, initiates a multi-stage infection process ultimately leading to the delivery of the WINELOADER backdoor. The attack chain begins with a spear-phishing email containing a malicious link to a ZIP file hosted on a compromised website. The expansion to political parties suggests an evolution in the group's intelligence gathering priorities, likely influenced by the current geopolitical climate. This campaign marks a significant shift in APT29's targeting, as they have traditionally focused on government and diplomatic entities. In late February 2024, Mandiant identified APT29, a Russian state-sponsored threat group, deploying a new backdoor called WINELOADER to target German political parties.

Splunk join two different keys