Unc4210

UNC4210 is a malicious software (malware) discovered by Mandiant in September 2022, suspected to be an operation of the Turla Team. This malware was identified as it re-registered three expired ANDROMEDA command and control (C2) domains and began selectively deploying KOPILUWAK and QUIETCANARY to victims infected with ANDROMEDA, primarily in Ukraine. UNC4210 initially used KOPILUWAK as a "first-stage" profiling utility, marking it as the first custom malware utilized by this suspected Turla Team cluster following ANDROMEDA. On September 6, 2022, after several months of ANDROMEDA beaconing without significant activity, UNC4210 downloaded and executed a WinRAR Self-Extracting Archive (WinRAR SFX) containing KOPILUWAK. Two days later, on September 8, Mandiant detected UNC4210 downloading QUIETCANARY to a host twice, executing commands through it only on the second occasion. UNC4210 then interacted with the QUIETCANARY backdoor, using it for compressing, staging, and exfiltrating data approximately 15 minutes later. The process involved making a GET request to a ClouDNS dynamic DNS subdomain previously used by ANDROMEDA and re-registered by UNC4210. UNC4210 demonstrated advanced capabilities by attempting to collect documents and data using WinRAR. It created multiple password-encrypted archives containing specific file types, notably only exfiltrating files created after January 1, 2021. Through KOPILUWAK, UNC4210 conducted basic network reconnaissance on the victim machine, looking for current TCP connections and network shares. Despite these actions, it remains unclear why UNC4210 conducted such reconnaissance, as the profiling commands are hard-coded in KOPILUWAK and would not yield different sets of data from the same host.