CovalentStealer Used in Attack on US Defense Entity

CovalentStealer is the name of a malicious tool used for data exfiltration. CovalentStealer was used in an attack on an entity operating in the US defense industrial base sector that was detailed only recently, despite taking place months ago.

CovalentStealer was just one of the components of the multi-payload attack. The hackers behind the hit are believed to be advanced persistent threat actors.

CovalentStealer was used alongside a malicious toolkit called Impacket. Impacket was the malware used to originally compromise the target and establish a foothold on its systems. From that point on, CovalentStealer was used to exfiltrate sensitive information from the victim.

CovalentStealer was used to steal files stored on file shares and funnel them onto a cloud folder set up using Microsoft OneDrive and run by the hackers.

According to the investigations into the attack conducted by the CISA and the FBI, the APTs behind the attack likely stayed hidden on the compromised systems for a long time before putting their data theft operation into full gear.