OCEANMAP

OceanMap is a C#-based malware used by APT28, a Russia-linked group, as part of a sophisticated cyber attack campaign that started in 2020. The malware is designed to execute base64-encoded commands via cmd.exe, providing persistent and remote access to the targeted endpoint. Once a command is executed, OceanMap stores the results in the inbox directory, allowing APT28 to clandestinely monitor the attack and adjust its strategy accordingly. The APT28 group has targeted Ukrainian government entities and Polish organizations using phishing messages to deploy bespoke implants and information stealers such as MASEPIE, OCEANMAP, and STEELHOOK. In their latest campaign, they have used previously undetected malware like OCEANMAP to steal sensitive information from target networks. They also used it to upload data-stealing malware called Steelhook, which targets web browsers, and a backdoor called Oceanmap, which leverages email software. The Computer Emergency Response Team of Ukraine (CERT-UA) issued a warning about this new phishing campaign. One of the files downloaded to infected machines during these attacks is "Oceanmap," a tool for command execution via the Internet Message Access Protocol (IMAP). The original variant of OceanMap had information-stealing functionality, but this has since been transferred to another payload named "Steelhook," associated with the same campaign. This shift in tactics demonstrates the evolving nature of the threat posed by APT28.