OCEANMAP

Malware updated 15 days ago (2024-11-29T14:01:01.957Z)
Download STIX
Preview STIX
OceanMap is a C#-based malware used by APT28, a Russia-linked group, as part of a sophisticated cyber attack campaign that started in 2020. The malware is designed to execute base64-encoded commands via cmd.exe, providing persistent and remote access to the targeted endpoint. Once a command is executed, OceanMap stores the results in the inbox directory, allowing APT28 to clandestinely monitor the attack and adjust its strategy accordingly. The APT28 group has targeted Ukrainian government entities and Polish organizations using phishing messages to deploy bespoke implants and information stealers such as MASEPIE, OCEANMAP, and STEELHOOK. In their latest campaign, they have used previously undetected malware like OCEANMAP to steal sensitive information from target networks. They also used it to upload data-stealing malware called Steelhook, which targets web browsers, and a backdoor called Oceanmap, which leverages email software. The Computer Emergency Response Team of Ukraine (CERT-UA) issued a warning about this new phishing campaign. One of the files downloaded to infected machines during these attacks is "Oceanmap," a tool for command execution via the Internet Message Access Protocol (IMAP). The original variant of OceanMap had information-stealing functionality, but this has since been transferred to another payload named "Steelhook," associated with the same campaign. This shift in tactics demonstrates the evolving nature of the threat posed by APT28.
Description last updated: 2024-05-04T20:49:59.695Z
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Masepie is a possible alias for OCEANMAP. MASEPIE is a malicious software (malware) first discovered in December 2023, which is capable of establishing persistence on Windows machines and executing arbitrary commands. It is described as a small Python backdoor that enables the downloading and uploading of files. When victims click to view l
3
Steelhook is a possible alias for OCEANMAP. Steelhook is a malicious PowerShell script used by the Russia-linked Advanced Persistent Threat group, APT28, to steal sensitive information from compromised systems. The malware was discovered as part of a phishing campaign orchestrated by APT28, as reported by the Computer Emergency Response Team
3
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Backdoor
Malware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Threat Actors
To see the evidence that has resulted in these threatActor associations, create a free account
Alias DescriptionAssociation TypeVotes
The APT28 Threat Actor is associated with OCEANMAP. APT28, also known as Fancy Bear, Pawn Storm, Sofacy Group, Sednit, and STRONTIUM, is a threat actor linked to Russia. The group has been associated with cyber espionage campaigns across Central Asia and has historically targeted areas of national security, military operations, and geopolitical influUnspecified
2