FlyingYeti Uses WinRAR Flaw for Malware Attacks

Since Russia’s invasion of Ukraine on February 24, 2022, tensions have been high globally. Following the invasion, Ukraine imposed a moratorium on utility service evictions and terminations for unpaid debt, which ended in January 2024. During this time, a threat actor known as “FlyingYeti” exploited the situation.

“FlyingYeti” exploited Ukrainians’ anxiety over unpaid debt with a debt-themed phishing campaign, spreading the PowerShell malware “COOKBOX” to gain control over victims’ systems. The campaign utilized GitHub servers, Cloudflare workers, and a WinRAR vulnerability (CVE-2023-38831).

FlyingYeti Uses WinRAR Flaw

Reports indicate that FlyingYeti’s activities overlap with UAC-0149, a group targeting Ukrainian defense entities with the same malware in fall 2023. Between mid-April and mid-May 2024, FlyingYeti conducted reconnaissance for a potential Easter campaign.

They use dynamic DNS and cloud platforms for hosting malware and C2 servers. Likely aligned with Russia, FlyingYeti targets Ukrainian military entities, with Russian code comments and operational hours in the UTC +3 time zone.

In April, FlyingYeti’s reconnaissance targeted Ukrainian communal housing and utility payment processes. On April 22, 2024, they focused on 2016 changes introducing QR codes in payment notices and current developments in housing and utility debt.

On April 25, 2024, reconnaissance focused on the legal basis of restructuring housing debt and utilities like gas and electricity in Ukraine. These actions aimed to exploit payment-related lures, more likely to succeed with Ukrainian individuals.

Cloudflare researchers thwarted a phishing campaign set to launch for Easter. Analysis of the campaign code revealed threat actors using a spoofed version of the Kyiv Komunalka communal housing site, a payment processor for Kyiv residents.

Kyiv Komunalka facilitates payments for utilities, fines, and donations to Ukraine’s defense forces. The phishing campaign was set to deploy via email or encrypted signal message, likely containing a GitHub page link.

This page, when visited, prompts users to download a payment invoice document named “Рахунок.docx” (“Invoice.docx”). However, the actual download is a malicious RAR archive named “Заборгованість по ЖКП.rar” (“Debt for housing and utility services.rar”).

The RAR archive will include various files, including one with a filename featuring a Unicode character “U+201F” acting as whitespace between the name and extension. This file seems like a PDF document but is actually a malicious CMD file (“Рахунок на оплату.pdf[unicode character U+201F].cmd”).

When decompressed, the RAR extracts the malicious PDF, exploiting WinRAR vulnerability CVE-2023-38831. Subsequently, COOKBOX PowerShell malware executes, granting permanent access to the device. Once installed, COOKBOX connects to DDNS domain postdock[.]serveftp[.]com for C2, awaiting PowerShell cmdlets. Additionally, decoy documents in the RAR contain hidden tracking links via the Canary Tokens service.

Indicators Of Compromise