Cranefly

Cranefly, also known as UNC3524, is a threat actor group known for its sophisticated cyberattacks and stealthy techniques. These entities, which could be individuals, private companies, or even government entities, execute actions with malicious intent, often breaching cybersecurity systems to gather intelligence or cause harm. The lack of standard naming conventions in the cybersecurity industry can make tracking these groups challenging, but their activities are consistently monitored and analyzed by security firms. In October 2022, Symantec discovered a new malware used by the Cranefly hacking group that exploited Internet Information Services (IIS) logs. This innovative approach allowed the group to send and receive commands from the Command and Control (C2) server without triggering any alarms. The abuse of IIS logs represents a significant evolution in cyberattack methods, demonstrating Cranefly's advanced technical capabilities and highlighting the need for increased vigilance and enhanced security measures. The Cranefly group has further exploited this service to deliver an undocumented dropper, a type of malware that installs other malicious programs. In this case, the dropper was used to install a new backdoor and other tools, further expanding the group's control over compromised systems. This activity underscores Cranefly's focus on intelligence gathering and stealthy delivery and control of malware, making it a considerable threat to cybersecurity worldwide.