Pierluigi Paganini February 29, 2024

A new threat actor, tracked as dubbed SPIKEDWINE, has been observed targeting officials in Europe with a previously undetected backdoor WINELOADER.

Zscaler researchers warn that a previously unknown threat actor dubbed SPIKEDWINE has been observed targeting European officials. The cyberspies used a bait PDF document masqueraded as an invitation letter from the Ambassador of India, inviting diplomats to a wine-tasting event in February 2024.

The campaign is characterized by its very low volume and the advanced tactics, techniques, and procedures (TTPs) employed by the threat actors.

The PDF included a link to a fake questionnaire that redirects users to a mailcious ZIP archive hosted on a compromised site.

The ZIP archive contains an HTA file named wine.hta that contains obfuscated JavaScript code. The script executes the next stage and it uses an obfuscation technique that matches those of the publicly available obfuscator obfuscator.io.

The JavaScript code retrieves an encoded ZIP archive containing WINELOADER from the same domain.

Threat actors rely on DLL hollowing to inject WINELOADER into a randomly selected DLL from the Windows system directory. 

The researchers pointed out that WINELOADER is not injected into the DLLs that contain exported functions used by the malware.

The PDF document was uploaded to VirusTotal from Latvia on January 30, 2024. The evidence collected by Zscaler suggests that this campaign has been active since at least July 6, 2023.

The threat actor used compromised websites for hosting intermediate payloads or to act as C2 servers. To avoid detection the C2 server only responds to specific types of requests at certain times.

“The threat actor put additional effort into remaining undetected by evading memory forensics and automated URL scanning solutions.” concludes the report. “While we cannot currently attribute this activity to any known nation-state threat actor, we continue to monitor any new developments associated with this threat actor and ensure the necessary protections for our customers against these threats.“

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, SPIKEDWINE)