VERMIN

Vermin is a potent form of malware, short for malicious software, that infiltrates systems to exploit and damage them. This harmful program can enter your system through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it has the potential to steal personal information, disrupt operations, or hold data hostage for ransom. Vermin, also known as UAC-0020, is controlled by law enforcement agencies in the temporarily occupied Luhansk. The malware samples we've discovered fall largely into two categories: Quasar Rat and Vermin. Interestingly, many of the samples were from a new malware family, Vermin. The threat actor UAC-0020 used Vermin to launch attacks on the Defense Forces of Ukraine using the SPECTR WPS in tandem with a legitimate SyncThing, an operation dubbed the "SickSync" campaign. Further investigation into the initial samples and their infrastructure revealed a modestly sized campaign dating back to late 2015, employing both Quasar RAT and Vermin. All the samples identified have been linked to the same cluster of activity, strongly suggesting that the Vermin malware is exclusively used by this threat actor. Vermin is capable of supporting various commands and collects all keystrokes and clipboard data, encrypting it before storing it. Like many samples from the threat actors behind Vermin, our sample was initially packed with the popular .NET obfuscation tool ConfuserEx. However, using a combination of tools, we were able to unpack and deobfuscate the malware. This analysis offers valuable insights into the capabilities of Vermin and its role in significant cyber incidents, including the world's largest data breach, where it was used to hack Snowflake.