Spies and Steals Data: New Zagrebator Malware Discovered in Russia

Under the guise of sports event tickets and official documents, the attacker FakeTicketer distributes malware

Cybersecurity specialists from F.A.C.C.T. have discovered a new threat: email distributions from an attacker who has been given the code name FakeTicketer. He sends victims unique malware: a stealer, a remote access Trojan (RAT), and a dropper with the ability to steal data from browsers. This family of malicious files has been named Zagrebator.

Sample of a fake electronic ticket that the victim receives
Sample of a fake electronic ticket that the victim receives
Image source F.A.C.C.T.

Emails from FakeTicketer contain an attachment in the form of an archive, the name of which duplicates the subject of the email. The attached archive contains an executable file with a similar name related to the legend of the attack. As a lure document, FakeTicketer used fake tickets to sporting events: for example, to matches of the Russian football premier league, competitions in water rowing on kayaks and canoes.

The attacker uses self-written malware, which allows him to be more stealthy and bypass certain detection systems during the exploitation of the attack chain on the infected system. Based on the functionality of the malware, we believe that the motivation of the FakeTicketer attacker is espionage. Based on the discovered decoy files, we believe that his attacks are aimed, among other things, at the public sector.
Artyom Grishchenko, leading malware analysis specialist at the F.A.C.C.T. Threat Intelligence cyber intelligence department

In the fall and early winter, FakeTicketer began to use official documents as bait. In October, it was a scan of a school certificate, in December - regulatory acts of the administration of the city of Simferopol. Cybersecurity experts see Russian sports functionaries and officials of various levels as likely targets of the attacker.

Read materials on the topic:

Infected network equipment at nodal stations could have caused the Runet failure

Fraudulent networks: almost 40% of cybercrimes in Russia are committed using IT technologies

Sources:
F.A.C.C.T.
2025-01-17 17:44:12 Information Security F.A.C.C.T. FakeTicketer Zagrebator
Telegram Дзен

Now on home

All news