WINELOADER Backdoor Deployed Against German Targets
Russian-affiliated threat actors have deployed the WINELOADER backdoor in recent cyber assaults directed at German political organizations. In late February 2024, researchers from Mandiant identified the Russia-associated group APT29 utilizing a modified version of the WINELOADER backdoor to target German political parties, employing a lure themed around the Christian Democratic Union (CDU).
This marks the first instance of Mandiant observing the APT29 subcluster directing its efforts towards political entities, indicating a burgeoning interest beyond their usual focus on diplomatic missions. The targeted groups received phishing emails, written in German, purporting to be invitations to a dinner reception on March 1, featuring the CDU logo. These emails contained a link leading to a malicious ZIP file hosted on a compromised website.
Within the ZIP file was a ROOTSAW dropper, utilized to deploy a second-stage lure document also themed around the CDU, alongside a WINELOADER payload retrieved from the site "waterforvoiceless[.]org/util.php". The WINELOADER backdoor boasts multiple features and functions that overlap with other malware in APT29's arsenal, such as BURNTBATTER, MUSKYBEAT, and BEATDROP, indicating a likely common origin.
WINELOADER Attack Vector and Infiltration Method
WINELOADER is initiated through DLL side loading into a legitimate Windows executable, followed by decryption of the main implant logic using RC4. Zscaler ThreatLabz initially identified WINELOADER in February 2023, attributing the campaign to an APT known as SPIKEDWINE.
Zscaler warned that SPIKEDWINE, a previously unidentified threat actor, had been observed targeting European officials. The cyber spies utilized a bait PDF document masquerading as an invitation letter from the Ambassador of India, inviting diplomats to a wine-tasting event in February 2024.
The campaign is characterized by its low volume and the utilization of advanced tactics, techniques, and procedures (TTPs) by the threat actors. The report concludes that, based on the SVR's mandate to gather political intelligence and the historical targeting patterns of this APT29 cluster, this activity poses a significant threat to European and other Western political parties across the political spectrum.
