Commonmagic

CommonMagic is a malicious software framework that has been actively used since at least September 2021 to target government, agriculture, and transportation organizations located in the Donetsk, Lugansk, and Crimea regions. It was developed by an APT group linked to the Russo-Ukrainian conflict and operates by infecting systems with various modules for tasks such as traffic encryption and decryption, document theft, and screenshot capturing. This malware communicates with a command-and-control server, which then triggers the infection within the CommonMagic framework. The CommonMagic malware is closely related to another malware framework, CloudWizard, both of which were discovered during an investigation initiated in 2022. The similarities between CommonMagic and CloudWizard are significant, indicating a shared origin or developer. Both use the RC5Simple library for encryption and the RapidJSON library for parsing JSON objects. They also share similar strings in their internet communication modules and have analogous naming conventions for files uploaded to their respective C2 servers. Additionally, victim IDs extracted from both malwares contain a date followed by two identical letters, albeit with slight variations in format. However, there are notable differences in the implants used by each malware: DUREX43 in CloudWizard and Hwo7X8p in CommonMagic. Victims of CommonMagic and CloudWizard are primarily located in areas of conflict in Eastern Europe, particularly those involved in the Ukrainian conflict. These malware frameworks represent an escalation in cyber warfare, using cloud services to conduct sophisticated attacks. The discovery of these interconnected frameworks highlights the increasing complexity and modularity of modern malware, as well as the geopolitical context in which they operate.