Prikormka

Prikormka is a type of malware that was used in Operation Groundbait, a cyber threat campaign that took place between 2008 and 2016. The malware is typically deployed through a dropper contained within malicious email attachments and has 13 different components designed to harvest various types of data from compromised machines. Over the years, Prikormka has been connected to other Advanced Persistent Threat (APT) activities including Operation BugDrop and PowerMagic. In recent research, Kaspersky experts found multiple similarities between Prikormka and two other malwares: CommonMagic and CloudWizard. These similarities include the same name format for files uploaded to the C2 server, similar order of extensions used in extension lists, and identical format string for directory listings. Additionally, several modules of CloudWizard resemble those from Prikormka and BugDrop, although they have been rewritten from C to C++. Based on these findings, Kaspersky experts have concluded that the malicious campaigns of Prikormka, Operation Groundbait, Operation BugDrop, CommonMagic, and CloudWizard may all be attributed to the same active threat actor. This suggests an ongoing threat from a single source that has evolved its tactics and tools over time, but retained certain identifiable characteristics. This information can be crucial in developing defenses against these persistent threats.