Operation Oxidový: Czech Military Targeted by NATO-Themed Malware Campaign

Introduction

On August 28, 2024, Seqrite Labs' APT team uncovered a sophisticated malware campaign targeting the Czech Republic's government and military officials. Known as "Operation Oxidový," the campaign leverages NATO-themed decoys to infiltrate and compromise sensitive systems. The attack employs a combination of malicious LNK files, batch scripts, and advanced post-exploitation frameworks, highlighting the increasing threat of state-sponsored cyber operations in Eastern Europe.

Report Overview

Operation Oxidový was first identified when a malicious ZIP file surfaced on platforms like VirusTotal. This ZIP file contained NATO-themed decoys, likely designed to exploit the Czech Republic's political and military ties with NATO. The campaign is a well-coordinated effort to penetrate key government sectors. It begins with distributing a ZIP file that includes a deceptive LNK file titled "The importance of and outlook for the Czech Republic in NATO.pdf.lnk." This file serves as the entry point for the malware, executing a batch script that triggers a series of malicious activities.

The initial infection vector involves the execution of the LNK file, which runs a batch script named "AdobeAcrobatReader.bat." This script is responsible for deploying a decoy PDF document titled "Postup_zmeny_hesla_z_IMO.pdf," which misleadingly instructs the user on changing passwords within a military network. Additionally, the script renames a hidden executable file, disguising it as "AdobeReader.exe," and places it in the startup folder to ensure persistence. To further conceal the malicious activity, the script modifies file attributes, making the LNK file and associated payloads less detectable to the user.

The second stage of the attack introduces a Rust-based loader known as Freeze, which threat actors have repurposed for this campaign. Originally developed for red-team exercises, Freeze disables Event Tracing for Windows (ETW) to evade detection by security tools. It also injects the decrypted shellcode into a suspended notepad.exe process and deploys a malicious DLL payload identified as part of the Havoc framework. This payload is critical in establishing a foothold within the targeted system.

In the final stage, the operation deploys the Havoc Demon. This post-exploitation payload connects to a Command-and-Control (C2) server. The Demon executes command dispatching, system information gathering, and sophisticated obfuscation techniques to evade detection. This stage demonstrates the campaign's advanced capabilities and the potential for significant damage to targeted systems.

Operation Oxidový poses significant risks to the Czech Republic's national security. By targeting government and military officials, the attackers aim to gain unauthorized access to sensitive information and disrupt the country's strategic operations. Advanced tools like Freeze and Havoc suggest a high level of sophistication, indicative of a state-sponsored actor. Given the geopolitical tensions in the region, this attack is likely part of a broader effort to destabilize NATO's influence in Eastern Europe.

Insights and Analysis

Security researchers at Seqrite Labs have linked Operation Oxidový to a potential Russian threat actor, citing the use of advanced offensive tooling and the geopolitical context of the attack. While the evidence points towards a state-sponsored operation, the attribution remains with medium confidence due to the limited direct evidence available. This campaign aligns with known Russian cyber tactics, particularly in targeting Eastern European countries with politically sensitive operations.

Organizations should implement robust security measures to mitigate the threat posed by Operation Oxidový. Enhanced email filtering mechanisms can help detect and block malicious attachments before they reach end-users. Regular security audits are essential to identify and remediate vulnerabilities in critical systems that similar campaigns could exploit. Additionally, educating employees on the risks of phishing and spear-phishing attacks, emphasizing verifying the authenticity of email attachments, is crucial in reducing the likelihood of successful attacks.

Operation Oxidový underscores the persistent and evolving nature of cyber threats facing government and military entities. The attackers' use of NATO-themed lures and sophisticated malware highlights their capability to execute targeted and highly effective campaigns. As cyber threats continue to grow in complexity, organizations must remain vigilant and proactive in their defence strategies.

Indicators of Compromise (IOCs)

MITRE ATT&CK Techniques

References

Operation Oxidový: Sophisticated Malware Campaign Targets Czech Officials Using NATO-Themed Decoys - Blogs on Information Technology, Network & Cybersecurity | Seqrite

Seqrite Labs APT-Team has recently found a campaign targeting the Czech Republic. The campaign targets government and military officials with multiple lures aimed at the relationship between NATO and the Czech Republic. The entire malware ecosystem is involved in this campaign, starting from the loader to a well-known Command-and-Control framework known as HavocC2 and Freeze …

SeqriteSubhajeet Singha