KOPILUWAK

KopiLuwak is a JavaScript-based malware used for command and control (C2) communications and victim profiling. It was initially dropped by Pensive Ursa using an MSIL dropper in a G20-themed attack in 2017, and later as a self-extracting archive (SFX) executable in late 2022. Upon execution, the SFX created and executed KopiLuwak from a specific file path, enabling it to infiltrate systems undetected. Both KopiLuwak and another malware, QUIETCANARY, were downloaded successively at different times, suggesting potential haste or operational deficiency on the part of the attackers. This pattern of activity aligns with Turla’s historical reuse of tools and malware ecosystems, including KopiLuwak, in cyber operations. In one notable instance, UNC4210, a suspected cluster of the Turla Team, used KopiLuwak as a "first-stage" profiling utility following the use of another malware, ANDROMEDA. Through KopiLuwak, UNC4210 conducted basic network reconnaissance on the victim machine, looking for all current TCP connections and network shares. The ANDROMEDA-injected process then downloaded and executed a WinRAR SFX containing KopiLuwak to a specific file path. Following extensive victim profiling by KopiLuwak, the ANDROMEDA injected process made a GET request to a specific URL which downloaded and executed QUIETCANARY. Two days after the initial execution and reconnaissance performed with KopiLuwak, Mandiant detected UNC4210 downloading QUIETCANARY to a host twice, but only executing commands through it on the second time. These actions highlight the complex and multi-stage nature of these cyber attacks, with KopiLuwak serving as a key tool in the attackers' arsenal.