RedStinger

Also known as: Bad Magic, Bad magic, CloudWizard, RedStinger

In October 2022, Kaspersky identified an active infection of government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions. Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar methods. The victims navigated to a URL pointing to a ZIP archive hosted on a malicious web server.

🌍 Country ["[Unknown]"]

Associated Operations

2020 2023-05 CloudWizard APT: the bad magic story goes on Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020 https://securelist.com/cloudwizard-apt/109722/ https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger

Introduction

In October 2022, Kaspersky identified an active infection of government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions. Although the initial vector of compromise is unclear, the details of the next stage imply the use of spear phishing or similar methods. The victims navigated to a URL pointing to a ZIP archive hosted on a malicious web server.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2020
  • 2023-05
  • CloudWizard APT: the bad magic story goes on
  • Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020
  • https://securelist.com/cloudwizard-apt/109722/
  • https://www.malwarebytes.com/blog/threat-intelligence/2023/05/redstinger

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • CommonMagic:
  • PowerMagic:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.