UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware
Russian state-sponsored group UAC-0145 (Sandworm) utilizes ClickFix social engineering to infect Ukrainian targets with data-stealing malware. Attackers deploy fake CAPTCHAs on compromised websites that instruct users to run malicious PowerShell commands, leveraging EtherHiding to fetch domains from Ethereum smart contracts. The malware suite includes SCOUTCURL for reconnaissance, loaders like FLUIDLEECH and LOADLOOP, and FREAKYPOLL, a Python-based backdoor. A separate Android campaign distribut
Analysis
TL;DR
- Russian state-sponsored group UAC-0145 (Sandworm) utilizes ClickFix social engineering to infect Ukrainian targets with data-stealing malware.
- Attackers deploy fake CAPTCHAs on compromised websites that instruct users to run malicious PowerShell commands, leveraging EtherHiding to fetch domains from Ethereum smart contracts.
- The malware suite includes SCOUTCURL for reconnaissance, loaders like FLUIDLEECH and LOADLOOP, and FREAKYPOLL, a Python-based backdoor.
- A separate Android campaign distributes the COWARDDUCK backdoor disguised as security tools via messaging apps, exfiltrating files and geolocation data through Dropbox APIs.
- This campaign highlights the evolution of nation-state tactics by combining web cloaking services with blockchain-based infrastructure to evade detection.
Why It Matters
This incident underscores the persistent effectiveness of ClickFix as a social engineering vector among advanced persistent threats (APTs), demonstrating how state-sponsored actors continue to exploit user trust in standard web interactions like CAPTCHAs. For security practitioners, it highlights the critical need to monitor for unusual PowerShell executions and the emerging trend of using blockchain technologies (such as Ethereum smart contracts) to dynamically resolve malicious infrastructure, bypassing traditional static blacklists.
Technical Details
- ClickFix Mechanism: Compromised websites serve fake CAPTCHA challenges via a bespoke tool called SMARTAXE, which uses Cloaking.House for traffic filtering to target specific IPs. The CAPTCHA text instructs victims to paste and execute a PowerShell command in their terminal.
- Blockchain Integration: The technique "EtherHiding" is employed to store the domain names of remote resources within Ethereum smart contracts. The malicious scripts retrieve these domains dynamically, making the infrastructure harder to block statically.
- Malware Components: The initial payload often involves downloading a VBS file (e.g., GHETTOVIBE) to the Startup directory. Subsequent stages include SCOUTCURL for system reconnaissance, FLUIDLEECH masquerading as antivirus software, and FREAKYPOLL, a Python backdoor.
- Android Backdoor (COWARDDUCK): Distributed via APK files disguised as security tools on messaging apps. It collects contacts, specific file types from various directories, and real-time geolocation. Command and control (C2) communication utilizes the Dropbox API for uploads and legitimate sites like Steam Community for command retrieval.
Industry Insight
- Infrastructure Obfuscation: Security teams must expand threat intelligence feeds to include monitoring of Ethereum smart contracts and blockchain transaction patterns associated with known threat actors, as static IP/domain blocking becomes less effective against dynamic, blockchain-resolved C2 channels.
- User Education on CLI Risks: The success of ClickFix relies on users blindly executing terminal commands. Organizations should reinforce training on the dangers of running unverified PowerShell or Bash commands prompted by web interfaces, emphasizing that legitimate services rarely ask users to manually execute code to solve CAPTCHAs.
- Mobile Threat Landscape: The use of COWARDDUCK indicates that mobile devices are increasingly targeted for comprehensive data exfiltration (files + location). Mobile Device Management (MDM) solutions and endpoint detection and response (EDR) for mobile platforms should be updated to detect suspicious API usage patterns, particularly interactions with cloud storage services like Dropbox from non-standard applications.
Disclaimer: The above content is generated by AI and is for reference only.