Translated with AI from the Russian original.
Attackers sent malicious attachments from compromised user addresses, disguising them as routine business correspondence
Positive Technologies identified a large-scale campaign distributing the BoryptGrab malware, targeting at least 1,256 Russian organizations and individual entrepreneurs. Potential victims included financial and energy companies, as well as government agencies.
According to PT ESC TI experts, the threat actor, designated as VecnaHopper, sent malicious emails from hacked mailboxes. Specialists identified at least five mass attack waves and discovered more than 700 malware samples associated with the campaign. In one case, a compromised address was used for a new mailing just eight days after the initial infection.
Individual entrepreneurs accounted for 44% of targets, banks and financial organizations for 14%, and fuel and energy sector enterprises and government agencies for 11% each. The emails simulated regular business correspondence: orders, inquiries, and official notifications. The attachments were password-protected archives containing a legitimate Visual Studio debugger and a malicious library.
BoryptGrab is capable of stealing credentials and session information from browsers, messages and data from Telegram, Discord, Steam, and cryptocurrency wallets. In addition, the program collects documents from the computer and takes screen captures.
Experts warn that even an email from a familiar sender can be malicious if their account has been compromised. If infection is suspected, it is recommended to change passwords from a secure device, terminate active sessions across services, and check whether the compromised mailbox was used for further mailings.
