VERMIN

Malware updated 2 months ago (2024-08-20T12:17:45.853Z)
Download STIX
Preview STIX
Vermin is a potent form of malware, short for malicious software, that infiltrates systems to exploit and damage them. This harmful program can enter your system through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it has the potential to steal personal information, disrupt operations, or hold data hostage for ransom. Vermin, also known as UAC-0020, is controlled by law enforcement agencies in the temporarily occupied Luhansk. The malware samples we've discovered fall largely into two categories: Quasar Rat and Vermin. Interestingly, many of the samples were from a new malware family, Vermin. The threat actor UAC-0020 used Vermin to launch attacks on the Defense Forces of Ukraine using the SPECTR WPS in tandem with a legitimate SyncThing, an operation dubbed the "SickSync" campaign. Further investigation into the initial samples and their infrastructure revealed a modestly sized campaign dating back to late 2015, employing both Quasar RAT and Vermin. All the samples identified have been linked to the same cluster of activity, strongly suggesting that the Vermin malware is exclusively used by this threat actor. Vermin is capable of supporting various commands and collects all keystrokes and clipboard data, encrypting it before storing it. Like many samples from the threat actors behind Vermin, our sample was initially packed with the popular .NET obfuscation tool ConfuserEx. However, using a combination of tools, we were able to unpack and deobfuscate the malware. This analysis offers valuable insights into the capabilities of Vermin and its role in significant cyber incidents, including the world's largest data breach, where it was used to hack Snowflake.
Description last updated: 2024-08-20T12:17:15.273Z
What's your take? (Question 1 of 0)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the VERMIN Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more