EclecticIQ analysts documented in a report published on EclecticIQ a Sandworm (APT44, UAC-0145) campaign targeting Ukrainian Windows users through trojanized Microsoft KMS activation tools and fake Windows updates — likely ongoing since late 2023. The campaign exploits Ukraine's estimated 70–80% unlicensed software rate (particularly in state institutions) as a large-scale initial infection vector. Seven distinct distribution campaigns were identified, sharing infrastructure linked via WHOIS records to ProtonMail/Protonmail.com registrant emails and PDR Ltd./GMO Internet registrars.
BACKORDER Go Loader: Windows Defender Exclusions, LOLBAS Evasion, and DcRAT Delivery
The primary campaign uses a trojanized KMSAuto++x64_v1.8.4.zip distributed via torrent. On execution, a fake KMS activation UI is displayed while the BACKORDER Go-based loader runs silently in the background. BACKORDER disables Windows Defender via powershell.exe -Command Add-MpPreference -ExclusionPath <path>, uses multiple LOLBAS/LOLBIN techniques for defense evasion, and decodes a Base64-encoded URL via main_convert_B64_to_Str() to reveal kmsupdate2023[.]com/kms2023.zip. The main_get_zip() function downloads the heavily obfuscated DcRAT payload and stores it at \AppData\Roaming\kms2023\kms2023.exe with an additional copy at \AppData\Local\staticfile.exe. DcRAT establishes C2 to onedrivepack[.]com/pipe_RequestPollUpdateProcessAuthwordpress.php, exfiltrating screenshots, keystrokes, browser cookies/history/credentials, FTP credentials, system info, and saved credit card data. Two scheduled tasks (staticfiles and staticfile) maintain persistence via schtasks.exe executing staticfile.exe with elevated privileges.
PyInstaller Variant: Russian-Language Debug Symbols and New BACKORDER DLL Version
A November 25, 2024 VirusTotal upload revealed a PyInstaller-compiled 64-bit Python 3.13 variant with Russian-language comments in Functions.py ("We will change the working directory to the script directory") and Functions_2.py (permission error strings), and debug symbol remnants exposing the build path New_dropper.go compiled under an IEUser account (Microsoft test VM default). The variant deploys Microsoft-Activation-Scripts from GitHub as cover, copies malicious DLLs (Runtime Broker.dll, stream.x86.x.dll) to %LOCALAPPDATA%\Microsoft-Activation-Scripts\, and creates a scheduled task named OneDrive Reporting Task-S-1-6-91-2656291417-2341898128-2085478365-1000 executing rundll32.exe stream.x86.x.dll,ExportedFunction at login. Runtime Broker.dll is assessed with medium confidence as a new BACKORDER version downloading from activationsmicrosoft[.]com/activationsmicrosoft.php.
Kalambur Backdoor: TOR SOCKS5 C2, OpenSSH, RDP Hidden Admin, and 60-Minute Scheduled Task
Infrastructure pivoting from kmsupdate2023[.]com revealed the Kalambur backdoor (named after its domain and the Russian word for "pun") — a C#-based downloader (kalambur2021_v39.exe) that installs a repackaged TOR binary, reconfigures it as a SOCKS5 proxy on 127.0.0.1:9050, and communicates via curl.exe to onion address 2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid[.]onion. A WindowsUpdateCheck scheduled task runs rata.vbs every 60 minutes under SYSTEM. The backdoor installs Win32-OpenSSH (TCP port 22), configures RDP on port 3389 with reduced security, and creates a hidden administrator account (Admin/WGUtilityOperator, password 1qaz@WSX) concealed from the Windows login screen via registry edits. All installer artifacts and temporary scripts are cleaned post-execution.