Deliverycheck

DeliveryCheck is a novel .NET-based malware that has been identified by Microsoft's Threat Intelligence as being used in targeted attacks against the defense sector in Ukraine and Eastern Europe. The threat actor behind these attacks is known as Secret Blizzard (also referred to as KRYPTON or UAC-0003). Distributed via email, DeliveryCheck typically arrives in documents containing malicious macros. Once activated, it can deliver a variety of secondary payloads, potentially causing significant harm to infected systems. On July 19, 2023, Microsoft Threat Intelligence reported that the same threat actor was also targeting Microsoft Exchange servers. They were installing server-side components of DeliveryCheck using PowerShell Desired State Configuration (DSC), a legitimate tool repurposed for malicious ends. DSC generates a Managed Object Format (MOF) file containing a PowerShell script that loads the embedded .NET payload into memory, effectively turning a legitimate server into a command-and-control center for the malware. The cybersecurity researchers at Microsoft Threat Intelligence and the Ukrainian government’s Computer Emergency Response Team (CERT-UA) have corroborated each other's findings. Both entities have issued warnings about the Russian Turla hacker group's use of this new malware, alternately referred to as Capibar or Gameday, in recent attacks on the defense industry and Microsoft Exchange servers. This underscores the need for heightened vigilance and robust cybersecurity measures, particularly within sectors of strategic importance.