CERT-UA published an advisory on CERT-UA documenting a Sandworm (UAC-0133/UAC-0002/APT44) plan targeting approximately 20 energy, water, and heat supply enterprises across ten Ukrainian regions in March 2024. The campaign combined two new Linux tools — BIASBOAT (a Linux variant of the known QUEUESEED backdoor) and LOADGRIP (a ptrace-based injector) — with existing Windows tooling including QUEUESEED and GOSSIPFLOW, deployed against industrial process control systems (ICS). CERT-UA assesses the campaign was designed to amplify the effect of spring 2024 missile strikes against Ukrainian infrastructure by pre-positioning sabotage capabilities inside operational technology environments.
QUEUESEED, BIASBOAT, and LOADGRIP: C++ Windows Backdoor, Linux ELF Variant, and machine-id-Keyed Payload Encryption
QUEUESEED is a C++ backdoor communicating over HTTPS with a C2 server in JSON format, encrypting data using RSA+AES. It collects basic system information (OS, language, username), executes commands as separate processes or via %COMSPEC% /c, reads/writes files, updates its configuration, and self-deletes on demand. The backdoor configuration (containing the C2 URL) is AES-encrypted with a static key embedded in the binary. An AES-encrypted command queue stored in the Windows registry uses the %MACHINEGUID% value as the decryption key. Persistence is established by a dropper creating either a scheduled task or a Run registry entry. BIASBOAT is a Linux ELF variant of QUEUESEED written in C, launched exclusively via the LOADGRIP injector. LOADGRIP (C, ELF) injects payloads using the ptrace API — with the payload delivered in AES-128-CBC encrypted form, where the decryption key is derived from a static constant in the code combined with the target machine's machine-id value, making each BIASBOAT instance uniquely bound to a specific host.
Supply Chain Compromise: Three Confirmed Chains, WEEVELY Webshells, and Vendor Software Vulnerabilities
CERT-UA confirmed at least three compromised supply chains — initial access either correlating with installation of vendor software containing embedded backdoors and vulnerabilities, or resulting from legitimate vendor remote access for maintenance. On ICS-connected computers running vendor software, attackers pre-positioned PHP webshell WEEVELY, PHP tunnel REGEORG.NEO, or PIVOTNACCI for lateral movement from OT into enterprise corporate networks. Contributing factors identified by CERT-UA include: insufficient network segmentation between vendor systems and ICS networks (including inadequate internet isolation), and negligent vendor security practices — superficial source code analysis would reveal trivial RCE vulnerabilities in the production software provided to Ukrainian utilities. At some enterprises, LOADGRIP/BIASBOAT had been installed as early as 2023.
GOSSIPFLOW Go Tunnel, Windows Toolchain, and Supporting Utilities
On Windows hosts, attackers deployed QUEUESEED alongside GOSSIPFLOW — a Go-based tool providing tunnel construction via the Yamux multiplexer library and SOCKS5 proxy functionality, previously observed in 2022 destructive attacks against Ukrainian water supply facilities involving SDELETE. Additional utilities observed in the campaign include CHISEL (network tunneling), LIBPROCESSHIDE (process concealment), JUICYPOTATONG, and ROTTENPOTATONG (privilege escalation). CERT-UA coordinated response from March 7–15, 2024, notifying all identified enterprises, removing and analyzing malware, establishing compromise timelines, and assisting with network equipment hardening and protection technology deployment.