Lonepage

Lonepage is a malicious software (malware) that has been actively utilized by the threat actor UAC-0099 since mid-2022 to compromise Ukrainian entities. This malware, along with others like Clogflag, Seaglow, and Overjam, is used to spy on victims and steal data. The operation employs phishing messages containing HTA, RAR, and LNK file attachments, which lead to the deployment of the Visual Basic Script (VBS) malware Lonepage. Once launched, this malware retrieves additional payloads, including keyloggers and info-stealers. The delivery of Lonepage is made possible through the exploitation of a high-severity flaw in the WinRAR software, identified as CVE-2023-38831. In some attacks, this critical vulnerability was exploited to deliver the Lonepage strain of malware. The last-stage malware in these attacks is Lonepage, which utilizes a PowerShell script to fetch next-stage browser stealer (Thumbchop) and keylogger (Clogflag) payloads. On December 26, 2023, it was reported that UAC-0099 was exploiting this flaw in WinRAR to deliver the Lonepage malware in attacks against Ukraine. The CERT-UA disclosed a cyber espionage campaign last month, targeting state organizations and media representatives in Ukraine. These attacks highlight the continued use of the WinRAR vulnerability to distribute the malicious Lonepage malware, underscoring the ongoing threat posed by this particular flaw.