Stealth Soldier Malware Used in Cyberespionage

In North Africa, a series of highly targeted espionage attacks have been carried out using a newly developed backdoor called Stealth Soldier.

The cybersecurity firm Check Point, in a technical report, described Stealth Soldier as a custom backdoor that operates primarily for surveillance purposes. Its functions include extracting files, recording screen and microphone activities, logging keystrokes, and stealing browser information.

The ongoing operation involves the use of command-and-control servers that mimic websites belonging to the Libyan Ministry of Foreign Affairs. The earliest signs of this campaign can be traced back to October 2022.

The attacks begin with potential targets downloading fake downloader binaries through social engineering tactics. These intermediate payloads serve as a channel for obtaining Stealth Soldier while simultaneously displaying a decoy PDF file.

Stealth Soldier, a custom modular implant, is believed to be used sparingly. It empowers surveillance capabilities by collecting directory listings and browser credentials, capturing keystrokes, recording audio from the microphone, taking screenshots, uploading files, and executing PowerShell commands. Check Point revealed that the malware employs different types of commands, including plugins downloaded from the command-and-control server and internal modules.

Stealth Soldier Still Actively Updated

The discovery of three versions of Stealth Soldier suggests that the operators actively maintain and update it.

While some components of the malware are no longer accessible, the screen capture and browser credential stealing plugins are said to have been inspired by open source projects found on GitHub.

Furthermore, the infrastructure supporting Stealth Soldier shows similarities with the infrastructure used in a previous phishing campaign called Eye on the Nile, which targeted Egyptian journalists and human rights activists in 2019.

This recent development suggests the potential re-emergence of the threat actor involved in Eye on the Nile. It indicates that the group is focused on surveillance activities targeting Egyptian and Libyan entities.