{"id":14600,"date":"2020-08-30T11:55:31","date_gmt":"2020-08-30T08:55:31","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=14600"},"modified":"2026-03-27T19:26:44","modified_gmt":"2026-03-27T16:26:44","slug":"deathstalker-detailed-look-at-a-mercenary-apt-group-that-spies-on-small-and-medium-businesses","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/deathstalker-detailed-look-at-a-mercenary-apt-group-that-spies-on-small-and-medium-businesses\/","title":{"rendered":"DeathStalker: detailed look at a mercenary APT group that spies on small and medium businesses"},"content":{"rendered":"\n

Kaspersky researchers have published a detailed overview of DeathStalker, a \u2018mercenary\u2019 advanced persistent threat (APT) group that has been leveraging efficient espionage attacks on small and medium-sized firms in the financial sector since at least 2012. The most recent discoveries demonstrate that the group has been targeting companies all over the world, from Europe to Latin America, highlight why cybersecurity protection is a necessity for small and medium-size organizations.<\/strong><\/p>\n\n\n\n

While state-sponsored threat actors and sophisticated attacks are often in the spotlight, businesses today are faced with a whole array of more immediate threats. These range from ransomware and data leaks to commercial espionage, and result in no less damage to the organizations\u2019 operations or reputation. These attacks are carried out by mid-level malware orchestrators and sometimes, by hacker-for-hire groups, such as DeathStalker, which Kaspersky has been tracking since 2018.<\/p>\n\n\n\n

DeathStalker is a unique threat group which mainly focuses on cyberespionage against law firms and organizations in the financial sector. The threat actor is highly adaptive and notable for using iterative fast-paced approach to software design, making them able to execute effective campaigns.<\/p>\n\n\n\n

Recent research enabled Kaspersky to link DeathStalker\u2019s activity to three malware families, Powersing, Evilnum and Janicab, which demonstrates the breadth of the groups\u2019 activity carried out since at least 2012. While Powersing has been traced by the security vendor since 2018, the other two malware families have been reported on by other cybersecurity vendors. Analysis of code similarities and victimology between the three malware families enabled researcher to link them to each other with medium confidence.<\/p>\n\n\n\n

The threat actors\u2019 tactics, techniques and procedures remained unchanged over the years: they rely on tailored spear-phishing e-mails to deliver archives containing malicious files. When the user clicks the shortcut, a malicious script is executed and downloads further components from the internet. This allows attackers to gain control over the victim\u2019s machine.<\/p>\n\n\n\n

One of the example is the use of Powersing, a Power-Shell-based implant that was the first detected malware from this threat actor. Once the victim\u2019s machine has been infected, the malware is able to capture periodic screenshots and execute arbitrary Powershell scripts. Using alternative persistence methods depending on the security solution detected on an infected device, the malware is able to evade detection, signaling to the groups\u2019 ability to perform detection tests before each campaign and update the scripts in line with the latest results.<\/p>\n\n\n\n

In the campaigns using Powersing, DeathStalker also employs a well-known public service to blend in initial backdoor communications into legitimate network traffic, thereby limiting the defenders\u2019 ability to hinder their operations. Using dead-drop resolvers \u2013 hosts of information that point to additional command and control infrastructure \u2013 placed on a variety legitimate social media, blogging and messaging services, the actor was able to evade detection and quickly terminate a campaign. Once victims are infected, they would reach out to and be redirected by these resolvers, thus hiding the communication chain.<\/p>\n\n\n\n

An example of a dead-drop resolver hosted on a legitimate public service<\/em><\/p>\n\n\n\n

DeathStalker activity has been detected across the world, further signifying the size of their operations. Powersing-related activities were identified in Argentina, China, Cyprus, Israel, Lebanon, Switzerland, Taiwan, Turkey, the United Kingdom and the United Arab Emirates. Kaspersky also located Evilnum victims in Cyprus, India, Lebanon, Russia, and the United Arab Emirates. Detailed information on Indicators of Compromise related to this group, including file hashes and C2 servers, can be accessed via the Kaspersky Threat Intelligence Portal<\/a>.<\/p>\n\n\n\n

\u201c<\/em>DeathStalker<\/em> is a prime example of a threat actor that organizations in the private sector need to defend themselves against. While we often focus on the activities carried out by APT groups, <\/em>DeathStalker<\/em> remind us that organizations that are not traditionally the most security-conscious need to be aware of becoming targets too. Furthermore, judging by their continuous activity, we expect that <\/em>DeathStalker<\/em> will continue to remain a threat with new tools employed to impact organizations. This actor, in a sense, is proof that small and medium-sized companies need to invest in security and awareness training too,\u201d<\/em> comments Ivan Kwiatkowski, senior security researcher at Kaspersky\u2019s GReAT. \u201cTo stay protected from <\/em>DeathStalker,<\/em> we advise organizations to disable the ability to use scripting languages, such as powershell.exe and cscript.exe, wherever possible. We also recommend that future awareness training and security product assessments include infection chains based on LNK (shortcut) files.\u201d<\/em><\/p>\n\n\n\n

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/strong><\/p>\n\n\n\n