Steelhook

Steelhook is a malicious PowerShell script used by the Russia-linked Advanced Persistent Threat group, APT28, to steal sensitive information from compromised systems. The malware was discovered as part of a phishing campaign orchestrated by APT28, as reported by the Computer Emergency Response Team of Ukraine (CERT-UA) in December 2023. Once installed on a system, Steelhook can extract data from web browsers, including login credentials, authentication cookies, and browsing history. This data is then exported to an actor-controlled server in Base64-encoded format. Steelhook specifically targets Google Chrome and Microsoft Edge browsers. The APT28 group has been employing Steelhook along with other previously undetected malware, such as OCEANMAP and MASEPIE, to infiltrate and exfiltrate sensitive data from targeted networks. These include Ukrainian government entities and Polish organizations. The threat actors also utilized the MASEPIE malware to load and execute OPENSSH for building a tunnel, and the OCEANMAP backdoor. In this campaign, the hackers leveraged these tools to upload the data-stealing malware Steelhook and a backdoor called Oceanmap, which manipulates email software. In response to these threats, Recorded Future employed a technique that altered Steelhook, submitting the malware source code to an LLM system. This action likely disrupted the functionality of the malware within infected systems. However, the attacks have paved the way for the deployment of additional malicious software, further escalating the cyber threat landscape. It's crucial for organizations to remain vigilant against such sophisticated threats and ensure robust cybersecurity measures are in place.