Telebots

TeleBots, a notorious threat actor group also known as Sandworm, BlackEnergy, Iron Viking, Voodoo Bear, and Seashell Blizzard, has been identified as operating under the control of Unit 74455 of the Russian GRU's Main Center for Special Technologies (GTsST). Active since 2000, the group is recognized for its sophisticated cyber-espionage campaigns. The group's activities have been linked to the Russian military intelligence agency, GRU, by Western intelligence agencies. TeleBots has developed a reputation for deploying various malware, including Linux ransomware on non-Windows servers, and using stolen Windows credentials to push ransomware in the final stages of their attacks. In June 2017, the group was implicated in the global outbreak of Diskcoder.C ransomware, also known as Petya and NotPetya. The outbreak reportedly originated from companies infected with a TeleBots backdoor, which resulted from the compromise of the financial software M.E.Doc, popular in Ukraine. Evidence of a strong code similarity between the Win32/Exaramel backdoor and the Industroyer main backdoor further links TeleBots to the Industroyer, NotPetya, and BlackEnergy incidents. The group's modus operandi typically involves the use of KillDisk malware in the final stages of their attacks, overwriting files with specific file extensions on the victims' disks. One such instance involved the deployment of VBS backdoor via a possibly compromised M.E.Doc update server mechanism. Documents dated between 2016 and 2020 reveal that the group has been contracted by Russian intelligence, including GRU Unit 74455, for the development of tools, training programs, and an intrusion platform. The consistent activity and evolving techniques of TeleBots underscore the persistent threat posed by state-sponsored cyber espionage groups.