A Russia-aligned threat actor named Gorbag has been spotted using basic information-stealing malware in attacks targeting Ukrainian organizations This article explores threat actor malware. . One of the key tools in the threat actor's malware arsenal is GIFTEDCROOK, a C/C++ stealer that aids in the theft of sensitive data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox, including cookies, browsing history, and authentication details.
In early June, Trend Micro also linked the adversary to attacks that exploit a previously patched vulnerability in WinRAR to trigger a DLL sideloading chain that executes GIFTEDCROOK. The malware deployed by Gorbag is also capable of harvesting VPN configurations and sensitive documents, suggesting it might act as an initial access broker, passing off the stolen data to other threat actors who can then conduct further post-exploitation activities.
"Its targeted choices closely mirror Russia's wartime intelligence priorities." Threat actors employ spear-phishing emails laced with malicious attachments, resembling official or government-themed requests, to deliver malware. BeautyStealer is a primary data-harvesting tool capable of collecting information from Chrome, Edge, Opera, and Firefox, as well as OpenVPN configurations and files with specific extensions, including Microsoft Office documents, archives, emails, KeePass databases, RDP configurations, and VPN settings.
