#ESETResearch analyzed a new #MustangPanda backdoor. It uses the open-source QMQTT library to communicate with its C&C server over #MQTT so we named it MQsTTang. This library depends on parts of the Qt framework, statically linked in the executable. https://www.welivesecurity.com/2023/03/02/mqsttang-mustang-panda-latest-backdoor-treads-new-ground-qt-mqtt/

A sample of MQsTTang was identified by @[email protected] on 2023-02-17. As stated in that thread, the backdoor uses the legitimate MQTT broker 3.228.54.173. This has the benefit of hiding their actual C&C servers from victims and analysts. https://twitter.com/Unit42_Intel/status/1626613722700472320

This malware family is also tracked as "Kumquat" by @[email protected]: https://twitter.com/aRtAGGI/status/1628067706443374592

Like in previous #MustangPanda campaigns, filenames related to politics and diplomacy are used to lure targets. These include:
- CVs Amb Officer PASSPORT Ministry Of Foreign Affairs.exe
- Documents members of delegation diplomatic from Germany.Exe
- PDF_Passport and CVs of diplomatic members from Tokyo of JAPAN.eXE

IoCs:
📄 SHA-1
02D95E0C369B08248BFFAAC8607BBA119D83B95B
430C2EF474C7710345B410F49DF853BDEAFBDD78
0EA5D10399524C189A197A847B8108AA8070F1B1
740C8492DDA786E2231A46BFC422A2720DB0279A
🚨 ESET Detection Name
Win32/Agent.AFBI trojan
🌐 Servers
80.85.156[.]151
80.85.157[.]3
185.144.31[.]86

@ESETresearch

The Dutch intelligence community has released a wide-ranging report on malicious Russian activities over the last year. The report notably states that significant Russian cyber operations related to Ukraine “have not yet become public knowledge”, owing in part to the sensitivity of the targeting and the means by which the operations were identified.

Before the “MOAR EVIDENCE OF CYBERWAR” crowd gets to this: keep in mind the Dutch specifically caveat all this by saying that the success of such Russian operations remain “limited” and call out that Russia has “found it difficult to synchronize cyber operations with other military operations”. Speed and volume of activity remain salient criteria of whether or not we classify activity as constituting what cyber war truly looks like, but impacts and coordination — taken together to actually support the achievement of objectives (h/t @benmonty) — is much more relevant.
——
This media link contains some translated quotes as well as a link to to report itself, which is in Dutch — https://www-therecord.recfut.com/dutch-intelligence-russia-cyberattacks-many-not-yet-public-knowledge/