Nobelium APT Hackers Introduce the Ceeloader Malware
The Nobelium Advanced Persistent Threat (APT) actor is back with a new piece of malware called Ceeloader. The criminals who had a main role in the SolarWinds attack are one of the most renowned cybercrime groups to come out of Russia. Some of their alternative names are Cozy Bear, APT29, and The Dukes.
Unsurprisingly, an advanced threat actor like this one does not rely on many public projects. Instead, most of their payloads consist of never before seen, custom-built malware. The Ceeloader is the latest example of this. As its name suggests, this is a Trojan Loader whose purpose is to ensure that secondary payloads are executed flawlessly on compromised systems. This malware is written in the C programming language, and its primary feature is the ability to load payloads into memory. This trick, also known as fileless execution, greatly reduces the footprint that malware activity leaves behind. Thanks to the Ceeloader Malware, Nobelium hackers could minimize the odds of their payloads being discovered and dissected by cybersecurity researchers.
It is important to add that the Nobelium APT hackers tend to go after high-profile targets, and their attacks are certainly not a major concern for regular users. One of their notable recent victims has been the United States Agency for International Development.
Ceeloader Delivers Other Cozy Bear Payloads
Apart from the fileless execution feature, the Ceeloader Malware also uses a peculiar trick to fetch payloads. It appears that the Nobelium hackers are using a network of compromised WordPress websites to host their payloads. This is probably meant to help avoid security measures that would usually filter connections to random, non-reputable sites. Furthermore, it makes it more difficult for security researchers to distinguish the malicious traffic from usual one. The Ceeloader Malware is likely to be used in combination with other custom-built Nobelium payloads - such as the Tomiris Backdoor Trojan. The scope of this campaign is not yet clear.
