Masepie

MASEPIE is a malicious software (malware) first discovered in December 2023, which is capable of establishing persistence on Windows machines and executing arbitrary commands. It is described as a small Python backdoor that enables the downloading and uploading of files. When victims click to view lure documents on attacker-controlled sites, they download this backdoor. One of the files MASEPIE downloads to infected machines is "Oceanmap," a C#-based tool for command execution via the Internet Message Access Protocol (IMAP). Another payload associated with this campaign is "Steelhook," which has information-stealing functionality. The malware was directed by a botnet based on compromised Ubiquiti routers, evidence suggests that both the WebDAV servers and the MASEPIE C2 servers may have been hosted on these compromised routers. This botnet was taken down by the U.S. government in early 2024. Advanced Persistent Threat group APT28 targeted Ukrainian government entities and Polish organizations using phishing messages designed to deploy bespoke implants and information stealers like MASEPIE, OCEANMAP, and STEELHOOK. APT28’s elaborate scheme ends with the execution of MASEPIE, OCEANMAP, and STEELHOOK, which are designed to exfiltrate files, run arbitrary commands, and steal browser data. In an update to their methodologies, ITG05 is utilizing the freely available hosting provider, firstcloudit[.]com to stage payloads to enable ongoing operations. The cybersecurity researchers Joe Fasulo, Claire Zaboeva, and Golo Mühr have been closely following and analyzing these developments.