In brief
A walk-through of the attack chain of the APT group Librarian Likho, following Kaspersky's recent report "Notes of a Digital Auditor". The whole attack is spear phishing, batch files and legitimate utilities, without a single binary implant: primitive, but it works, because people still run.pdf.exe. The value for a SOC is artifacts to hunt for: C:\Intel, nighttime scheduler tasks, AnyDesk under the name svchost, a dump of SAM/SYSTEM. A technical talk, but at the same time a showcase for the report and for Kaspersky's products.
Key points
- From Librarian Ghouls (it counted as cybercrime) the group was "renamed" Librarian Likho: the main thing is cyberespionage, the money is secondary; other vendors call it Rare Wolf, Rezet.
- The report "Notes of a Digital Auditor": ~330 pages, free as a PDF via a QR code, English on request, graphs in Obsidian and IOCs; three clusters of Ukrainian groups operating against Russia.
- "No doubt" state-sponsored, the resources are "limitless"; the targets are Russia, Belarus, Kazakhstan: industrial enterprises, research institutes, design bureaus, think tanks, universities. The principle is KISS: "we've got clumsy paws" or a bet on detection being hard.
- The vector is spear phishing with a RAR named "payment order"; inside it a.scr = an MZ/PE from Smart Install Maker (data.cab, installer.config, an empty runtime.cab of 36 bytes). Inside data.cab there is a genuine PDF payment slip for 600 rubles (a red herring, not a decoy), curl and a malicious LNK, apart from which there is nothing to detect.
- The installer noisily edits the registry to install 4t Tray Minimizer (4t-niagara.com, a pseudo-British VAT number), creates rezet.cmd, drops the toolkit into a hidden system C:\Intel; driver.exe is RAR 3.8 with the console strings wiped, the archive password is unique and its traces go "way back to 2010".
- Exfiltration goes by email through blat.exe; AnyDesk disguised as svchost is "the core of the whole attack", the password "qwerty 1234566" gives access with no permission prompt, Defender is killed with Defender Control.
- The night window: the tasks "shutdown at 5 a.m." and WakeUpAndLaunchEdge (set up by wol.ps1, it wakes the machine with the real Edge at 1 a.m.) — 4 hours is "enough to scoop up absolutely everything".
- SYSTEM and SAM are dumped through reg.exe, everything "related to electronic money" is gathered into wallet.rar under the same password, and XMRig with a malicious pool is planted on top.
- The arsenal also holds ngrok, WebBrowser PassView, Mipko Professional Keylogger (Pskov, a Ukrainian localization — "a hypothesis"), lateral movement over SMB; the infrastructure has a copy of the Mail.ru sign-in page that is "an exact match" (Gosuslugi, login.php, users-mail.ru), directory listing, phpMyAdmin "in Russian by default".
- A year ago the speaker put spear phishing at ~80%, now it is "something like 90-95%"; the conclusion — "First of all TI, first of all security awareness".
Tools, artifacts, technologies
- Delivery: Smart Install Maker (.scr = MZ/PE), data.cab / installer.config / runtime.cab, the PDF dummy, curl, LNK / trace.lnk — the only detectable thing.
- Persistence: rezet.cmd (alias Rezet; pauses via ping localhost, self-deletion), C:\Intel, 4t Tray Minimizer, driver.exe = RAR 3.8, AnyDesk, Defender Control, powercfg ×6, schtasks, wol.ps1, Edge.
- Exfiltration: reg.exe → SYSTEM/SAM, wallet.rar, blat.exe, XMRig (Monero), ngrok, WebBrowser PassView, Mipko, SMB.
- Defense (in the Q&A): AMSI, KFA, KES with file rollback, the KSN agreement, emulation of variable depth; the context — MS17-010, the Snowden leaks, VirusTotal.
Legal and organizational context
The report is devoted to Ukrainian groups operating against Russia; the group is described as state-sponsored, the evidence of its origin is circumstantial. Telemetry is limited by "regulators' requirements" and "all the GDPR stuff", the victim is not attributed — the mechanism is in the KSN agreement; publication follows the protocol "report → article → conferences", with a check that every implant is detected. Kaspersky is "not a government agency, we're a commercial company" and does not investigate incidents: "we're about Defensive, we're not about Offensive". The articles "272, 273, 274" are named without the words "Criminal Code".
Questions from the audience
The names of those asking were not spoken; the audience spoke without a microphone.
- Why batch files and not implants? → Two hypotheses: "paws" and a bet on detection being hard; but "they didn't invent this", all of it is something "we're very good at detecting", and PowerShell after AMSI is transparent.
- The same questioner: will there be a lightweight solution for Astra, "like Microsoft"? → "I'm not a product manager, I'm a techie"; there is KFA and there are trials.
- What was on the victim's machine, was there protection, why did it not work? → "We don't see everything" (regulators, GDPR); "where did you get the idea that it wasn't detected?"; the depth of emulation varies; "a catch-up strategy" is flawed, the proactive example is ransomware in KES; Defender is switched off when the privileges are there, and copying files "can't be detected".
- Could "their stupidity with the password" not be pushed further — a request to VKontakte or Mail.ru? → He does not know whether that is possible, "but it's not our job".
The speaker's position
A sarcastic, conversational lecture with asides addressed to the group's operators, who "will watch the stream or the recording either way". For him the blame lies first of all with the user who has no security awareness, and then with the SOC. He rates the attackers low, but admits that the primitive stuff works, and names the limits himself: he does not know what runtime.cab and the persistence are for, and the Mail.ru phishing he assumes "with medium confidence".
Quotes
- "Unfortunately, it's 2025 outside, and in this room too, by the way. And people still run.pdf.exe attachments."
- "And the worst part, you see, is that it works. It damn well works."
- "I don't know, if this got past the SOC, no idea where the SOC's looking."
- "Work the RU, and they come for you at dawn."