Article Details

Ukraine says hackers abuse SyncThing tool to steal data. The Computer Emergency Response Team of Ukraine (CERT-UA) reports about a new campaign dubbed "SickSync," launched by the UAC-0020 (Vermin) hacking group in attacks on the Ukrainian defense forces. The threat group is linked to the Luhansk People's Republic (LPR) region, which Russia has occupied almost in its entirety since October 2022. The hacker's activities commonly align with Russia's interests. The attack utilizes the legitimate file-syncing software SyncThing in combination with malware called SPECTR. Vermin's apparent motive is to steal sensitive information from military organizations. Attack details The attack begins with a phishing email sent to the target, carrying a password-protected RARSFX archive named "turrel.fop.wolf.rar." Upon launching the file, it extracts a PDF ("Wowchok.pdf"), an installer ("sync.exe"), and a BAT script ("run_user.bat"). The BAT executes sync.exe, which contains SyncThing and SPECTR malware, along with the required libraries. SyncThing establishes a peer-to-peer connection for data synchronization, which is used for stealing documents and account passwords. The legitimate tool is modified with new directory names and scheduled tasks to evade identification, while the component that displays a window when it's active has been removed. SPECTR is a modular malware that has the following capabilities: Data stolen by SPECTR is copied into subfolders within the '%APPDATA%\sync\Serve_Sync\' directory and subsequently transferred through syncing to the threat actor's system. CERT-UA believes Vermin decided to use a legitimate tool for data exfiltration to reduce the likelihood of security systems flagging the network traffic as suspicious. The cybersecurity agency notes that any interaction with SyncThing's infrastructure (e.g., *.syncthing.net) should be enough to consider a system compromised and launch an investigation to detect and uproot the infection.