Government, diplomatic entities, military organizations, law firms, and financial institutions primarily located in the Middle East have been targeted as part of a stealthy malware campaign as early as 2019 by making use of malicious Microsoft Excel and Word documents.
Russian cybersecurity company Kaspersky attributed the attacks with high confidence to a threat actor named WIRTE, adding the intrusions involved “MS Excel droppers that use hidden spreadsheets and VBA macros to drop their first stage implant,” which is a Visual Basic Script (VBS) with functionality to amass system information and execute arbitrary code sent by the attackers on the infected machine.
An analysis of the campaign as well as the toolset and methods employed by the adversary has also led the researchers to conclude with low confidence that the WIRTE group has connections to another politically motivated collective called the Gaza Cybergang. The affected entities are spread across Armenia, Cyprus, Egypt, Jordan, Lebanon, Palestine, Syria, and Turkey.
“WIRTE operators use simple and rather common TTPs that have allowed them to remain undetected for a long period of time,” Kaspersky researcher Maher Yamout said. “This suspected subgroup of Gaza Cybergang used simple yet effective methods to compromise its victims with better OpSec than its suspected counterparts.”
The infection sequence observed by Kaspersky involves decoy Microsoft Office documents deploying Visual Basic Script (VBS), potentially delivered through spear-phishing emails that purportedly relate to Palestinian matters and other trending topics that are tailored to the targeted victims.
The Excel droppers, for their part, are programmed to execute malicious macros to download and install a next-stage implant named Ferocious on recipients’ devices, while the Word document droppers make use of VBA macros to download the same malware. Composed of VBS and PowerShell scripts, the Ferocious dropper leverages a living-off-the-land (LotL) technique called COM hijacking to achieve persistence and triggers the execution of a PowerShell script dubbed LitePower.
This LitePower, a PowerShell script, acts as a downloader and secondary stager that connects to remote command-and-control servers located in Ukraine and Estonia — some of which date back to December 2019 — and awaits further commands that could result in the deployment of additional malware on the compromised systems.
“WIRTE modified their toolset and how they operate to remain stealthy for a longer period of time. Living-off-the-land (LotL) techniques are an interesting new addition to their TTPs,” Yamout said. “Using interpreted language malware such as VBS and PowerShell scripts, unlike the other Gaza Cybergang subgroups, adds flexibility to update their toolset and avoid static detection controls.”
