EMPTYSPACE Downloader Targets Italian Victims
UNC4990, a financially motivated threat actor, is utilizing weaponized USB devices as an initial means of infecting organizations in Italy. According to a report from Mandiant, a security company which Google acquired in 2022, the attacks specifically target various industries, including health, transportation, construction, and logistics.
The modus operandi of UNC4990 involves a widespread USB infection followed by the deployment of the EMPTYSPACE downloader. During these operations, the group relies on third-party websites such as GitHub, Vimeo, and Ars Technica to host encoded additional stages, which are downloaded and decoded via PowerShell early in the execution chain.
Who is the UNC4990 Threat Actor?
Active since late 2020, UNC4990 is believed to operate from Italy, given its extensive use of Italian infrastructure for command-and-control (C2) purposes. The ultimate purpose of UNC4990 remains unclear, and it is uncertain whether the group serves solely as an initial access facilitator for other threat actors. In one instance, an open-source cryptocurrency miner was reportedly deployed after months of beaconing activity.
EMPTYSPACE Infection Mechanism
The infection process begins when a victim double-clicks on a malicious LNK shortcut file on a removable USB device, triggering the execution of a PowerShell script. This script is responsible for downloading EMPTYSPACE (also known as BrokerLoader or Vetta Loader) from a remote server through an intermediate PowerShell script hosted on Vimeo.
Four variants of EMPTYSPACE have been identified, written in Golang, .NET, Node.js, and Python. These variants act as conduits for fetching next-stage payloads over HTTP from the C2 server, including a backdoor named QUIETBOARD.
During this phase, popular websites like Ars Technica, GitHub, GitLab, and Vimeo are used for hosting the malicious payload. Notably, Mandiant researchers emphasized that the content hosted on these services posed no direct risk to everyday users, as the isolated content was benign.
QUIETBOARD, a Python-based backdoor, exhibits a broad range of features. It can execute arbitrary commands, alter crypto wallet addresses copied to the clipboard, propagate the malware to removable drives, capture screenshots, and collect system information. Additionally, the backdoor has modular expansion capabilities, enabling it to run independent Python modules such as coin miners and dynamically fetch and execute Python code from the C2 server.
