SPICA Backdoor Linked to Russian Hacker Collective
The Threat Analysis Group (TAG) at Google revealed that the Russian hacking group COLDRIVER is engaged in credential phishing activities targeting prominent NGOs, former intelligence and military personnel, as well as NATO governments.
TAG has been actively monitoring and reporting on COLDRIVER's espionage efforts aligned with Russian government interests. In an effort to enhance the community's awareness of COLDRIVER's activities, Wesley Shields of TAG highlighted their extended capabilities, which now include the deployment of malware.
COLDRIVER conducts campaigns against Ukraine, NATO nations, academic institutions, and NGOs. The group often adopts the guise of experts or individuals associated with the target to gain the trust of their victims.
TAG has observed COLDRIVER sending seemingly harmless PDF documents from impersonation accounts, presenting them as op-eds or articles seeking feedback for publication. Upon opening the PDFs, the text is revealed to be encrypted.
If the target expresses difficulty reading the document, the impersonation account responds with a link claiming to be a "decryption" utility. However, this utility is, in reality, a backdoor known as SPICA, providing the attackers access to the victim's machine.
What Exactly is the SPICA Backdoor?
The SPICA backdoor malware is a customer tool written in Rust, utilizing websocket communication for commanding and controlling affected devices. It empowers attackers to execute various commands on infected devices, such as running arbitrary shell commands, stealing cookies from browsers like Chrome, Firefox, Opera, and Edge, uploading and downloading files, accessing the filesystem, and exfiltrating documents.
Google utilizes TAG's findings to enhance the safety and security of its products. The identified websites, domains, and files are integrated into safe browsing protocols to prevent further exploitation. TAG also notifies targeted Gmail and Workspace users of potential attacks and encourages them to utilize enhanced safe browsing for added protection.
