Nobelium APT Hackers Introduce the Ceeloader Malware

The Nobelium Advanced Persistent Threat (APT) actor is back with a new piece of malware called Ceeloader. The criminals who had a main role in the SolarWinds attack are one of the most renowned cybercrime groups to come out of Russia. Some of their alternative names are Cozy Bear, APT29, and The Dukes.

Unsurprisingly, an advanced threat actor like this one does not rely on many public projects. Instead, most of their payloads consist of never before seen, custom-built malware. The Ceeloader is the latest example of this. As its name suggests, this is a Trojan Loader whose purpose is to ensure that secondary payloads are executed flawlessly on compromised systems. This malware is written in the C programming language, and its primary feature is the ability to load payloads into memory. This trick, also known as fileless execution, greatly reduces the footprint that malware activity leaves behind. Thanks to the Ceeloader Malware, Nobelium hackers could minimize the odds of their payloads being discovered and dissected by cybersecurity researchers.

It is important to add that the Nobelium APT hackers tend to go after high-profile targets, and their attacks are certainly not a major concern for regular users. One of their notable recent victims has been the United States Agency for International Development.

Ceeloader Delivers Other Cozy Bear Payloads

Apart from the fileless execution feature, the Ceeloader Malware also uses a peculiar trick to fetch payloads. It appears that the Nobelium hackers are using a network of compromised WordPress websites to host their payloads. This is probably meant to help avoid security measures that would usually filter connections to random, non-reputable sites. Furthermore, it makes it more difficult for security researchers to distinguish the malicious traffic from usual one. The Ceeloader Malware is likely to be used in combination with other custom-built Nobelium payloads - such as the Tomiris Backdoor Trojan. The scope of this campaign is not yet clear.

December 7, 2021
Loading...

Cyclonis Backup Details & Terms

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager Details & Terms

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.