Operation Chewbacca

At the end of June, the PT ESC team, during incident investigations, discovered a new group targeting at least oil and gas companies and the financial sector.

During attacks, the threat actors pursue destructive goals while maintaining a presence in the compromised infrastructure for a fairly long time.

For lateral movement within the infrastructure, they primarily use WinRM (usually in combination with WinRb) and SSH.

For persistence in the infrastructure, they mainly use server machines with high uptime (Windows\Linux); persistence is achieved via services in both cases. A wide range of tools is used as payloads:

• Agents for the merlin framework.
• An agent based on reverse_ssh.
• The GoSocks5Proxy utility based on go-socks5.
• ReverseProxy — a proprietary utility written in Rust.
• The GoRinet backdoor. It uses config encryption with a key derived from the physical address of the network adapter.

🐻 Various software is used to carry out destructive actions, including some that, by a number of indications, was developed using AI.

• The T-Riper wiper for network devices manufactured by Cisco/Huawei — deleting images, resetting device configuration, rebooting. They are used in combination with bash scripts for execution against remote targets.
• A custom wiper for remotely deleting QNAP data.
• To encrypt data on machines running Windows OS, a malware suite is used consisting of an orchestrator (with the ability to send encryption progress reports to a remote C2). Wiper generation is performed in a multithreaded manner, with individual executables created by adding “junk” to the overlay to evade detection. For automated propagation across the network, config files are used that specify known credentials from previously compromised accounts and target subnets.

The use of the CVE-2026-31431 vulnerability (CopyFail) for privilege escalation has also been noted, along with the custom tool CredsReseter for resetting passwords of Linux-like system accounts and Windows scripts for dumping credentials of third-party services.

Recommendations:

• Search for and monitor indicators of compromise.
• Perform signature scanning.
• Update the OS.

IoCs

File indicators:

Network indicators

#ir #dfir #ti #malware #apt #ioc
@ptescalator