Disrupting FlyingYeti's campaign targeting Ukraine

Campaign Overview

Cloudforce One has published findings from its investigation into FlyingYeti, a Russia-aligned threat actor, and the countermeasures taken to disrupt the group's phishing campaign targeting Ukrainian citizens. The operation leveraged debt-themed lures tied to the expiration of Ukraine's moratorium on evictions and utility service terminations, which ended in January 2024 after being introduced at the start of Russia's full-scale invasion in February 2022.

The campaign attempted to deploy the PowerShell malware COOKBOX, which would have provided FlyingYeti with persistent access to infected systems and the ability to execute follow-on objectives such as installing additional payloads. Between April 26, 2024, and the time of publication, Cloudforce One took steps to detect, deny, degrade, disrupt, and delay the actor's activities, including takedowns of actor-controlled infrastructure and collaboration with third parties to remove cloud-hosted malware. These efforts extended the actor's operational timeline from days to weeks; in one instance, FlyingYeti spent roughly eight hours debugging code as a direct result of the mitigations.

Threat Actor Profile

FlyingYeti is the cryptonym assigned by Cloudforce One to the group behind this campaign, which overlaps with UAC-0149 activity tracked by CERT-UA in February and April 2024. The actor relies on dynamic DNS (DDNS) for infrastructure and uses cloud-based platforms to host malicious content and for malware command and control (C2). Cloudforce One assesses that FlyingYeti is likely aligned with Russian interests, based on the actor's operational hours falling within the UTC+3 time zone, Russian-language comments found in the malware code, and a primary focus on Ukrainian military entities.

Debt-Themed Lures and Reconnaissance

In the days preceding the campaign, Cloudforce One observed FlyingYeti conducting reconnaissance related to Ukrainian communal housing and utility payment processes:

• April 22, 2024 – research into 2016 changes introducing QR codes in payment notices
• April 22, 2024 – research on current housing and utility debt developments in Ukraine
• April 25, 2024 – research on the legal basis for restructuring housing debt and utility debt involving gas and electricity

This reconnaissance aligns with the financial strain facing Ukrainian citizens following the government's January 9, 2024 decision to lift the payment moratorium. FlyingYeti sought to exploit this pressure by creating lures themed around debt restructuring and payment obligations.

The Spoofed Komunalka Site

The campaign was designed to direct targets to an actor-controlled GitHub page at hxxps[:]//komunalka[.]github[.]io, a spoof of the legitimate Kyiv Komunalka communal housing payment site. Komunalka processes utility payments for Kyiv region residents and also supports donations to Ukraine's defense forces. Based on prior FlyingYeti operations, targets may have reached the page via phishing email links or encrypted Signal messages.

The spoofed page displayed a prominent green button prompting users to download the document "Рахунок.docx" ("Invoice.docx"). The button was disguised as a link to an overdue payment invoice but instead triggered the download of a malicious archive named "Заборгованість по ЖКП.rar" ("Debt for housing and utility services.rar").

The download mechanism depended on a chain of requests:

• The target clicked the green button on hxxps[:]//komunalka.github[.]io
• The device sent an HTTP POST request to the Cloudflare Worker worker-polished-union-f396[.]vqu89698[.]workers[.]dev with the request body set to "user=Iahhdr"
• The Worker processed and evaluated the request body
• If conditions were met, the Worker fetched the RAR file from hxxps[:]//raw[.]githubusercontent[.]com/kudoc8989/project/main/Заборгованість по ЖКП.rar

Cloudforce One identified and remediated the actor-associated Worker, preventing malware delivery. FlyingYeti later adapted by loading the RAR file directly from GitHub instead of through the Workers domain.

Malware Delivery and Exploit

Analysis of the recovered RAR archive revealed multiple files, including one with a name containing the unicode character "U+201F". This character renders as whitespace on Windows systems, allowing file extensions to be hidden by adding excessive space between the filename and extension. The cleverly named file appeared to be a PDF document but was actually a malicious CMD file ("Рахунок на оплату.pdf[unicode character U+201F].cmd").

The archive also contained a benign PDF with the same name as the CMD file but without the unicode character, "Рахунок на оплату.pdf" ("Invoice for payment.pdf") — the same name as the directory created when the archive was decompressed. This naming overlap exploits the WinRAR vulnerability CVE-2023-38831: when an archive contains a benign file with the same name as a directory, WinRAR opens the entire directory contents, executing the malicious CMD when the target believes they are opening the benign PDF.

The CMD file contained FlyingYeti's COOKBOX PowerShell malware, designed to establish persistence on the infected host. Once installed, this COOKBOX variant makes requests to the DDNS domain postdock[.]serveftp[.]com for C2, awaiting PowerShell cmdlets to execute.

Decoy Documents

Alongside COOKBOX, the campaign opened several decoy documents containing hidden tracking links via the Canary Tokens service. The first document posed as an agreement for restructuring housing and utility debt, while the second was a user agreement outlining terms for the komunalka[.]ua payment platform. These decoys likely served to enhance the perceived legitimacy of the phishing activity.

Conclusions and Outlook

The debt-themed campaign is likely one of multiple themes FlyingYeti uses in a broader operation targeting Ukrainian entities, particularly defense forces. A recent CERT-UA disclosure from mid-April 2024 detailed a similarly structured FlyingYeti campaign using United Nations-themed lures involving Peace Support Operations to target Ukraine's military. As of the time of publication, Cloudforce One's defensive actions had prevented this latest campaign from succeeding.

FlyingYeti will likely continue to employ CVE-2023-38831 exploits in future phishing campaigns to deliver COOKBOX malware. Cloudforce One has provided recommendations, detections, and indicators of compromise to help defend against these operations.

How Cloudforce One Raised the Cost of FlyingYeti's Campaign

Cloudforce One's response to FlyingYeti was designed around a simple principle: force the actor to spend more time and effort than they planned. By carefully weighing each interdiction, the team aimed to stretch the campaign timeline from hours to weeks, disrupting the actor's workflow at every opportunity.

The campaign originally relied on a Cloudflare Worker to fetch a malicious RAR archive from GitHub. After Cloudforce One disabled the Worker, FlyingYeti shifted tactics. The actor created a new account to spin up additional Workers, which were subsequently disabled as well. This pushed the actor to load the RAR file directly from GitHub. A notification to GitHub resulted in the takedown of the archive, the project, and the hosting account.

Undeterred, FlyingYeti began experimenting with file-sharing platforms as alternate hosting. Cloudforce One observed the actor testing links on pixeldrain and Filemail, alternating between the two on their Komunalka phishing site:

• hxxps://pixeldrain[.]com/api/file/ZAJxwFFX?download=one
• hxxps://1014.filemail[.]com/api/file/get?filekey=e_8S1HEnM5Rzhy_jpN6nL-GF4UAP533VrXzgXjxH1GzbVQZvmpFzrFA&pk_vid=a3d82455433c8ad11715865826cf18f6

Cloudforce One kept GitHub informed of the actor's evolving behavior, which ultimately led to the removal of the Komunalka phishing site. An analysis of the files uploaded to the two file hosts revealed dummy payloads, likely planted to monitor who was accessing their infrastructure—both platforms provide view and download counts, and Filemail logs IP addresses. As of publication, FlyingYeti had not uploaded the malicious RAR to either service, and no alternative phishing or delivery methods were observed. The sequence of events and corresponding mitigations are laid out below.

Coordinating the Response

Cloudforce One leaned on its industry relationships to both warn the target community and actively disrupt FlyingYeti. The team worked directly with GitHub's Threat Intelligence and Trust and Safety Teams, and also shared findings with CERT-UA and partners at CrowdStrike, Mandiant/Google Threat Intelligence, and Microsoft Threat Intelligence.

Hunting for FlyingYeti in Your Environment

Organizations can look for signs of FlyingYeti activity using PowerShell, Microsoft Sentinel, or Splunk. These detections target WinRAR abuse and may also flag unrelated activity with a similar footprint.

PowerShell: A script like this one can scan WinRAR archives for evidence of CVE-2023-38831 exploitation.

CVE-2023-38831
Description:winrar exploit detection 
open suspios (.tar / .zip / .rar) and run this script to check it 

function winrar-exploit-detect(){
$targetExtensions = @(".cmd" , ".ps1" , ".bat")
$tempDir = [System.Environment]::GetEnvironmentVariable("TEMP")
$dirsToCheck = Get-ChildItem -Path $tempDir -Directory -Filter "Rar*"
foreach ($dir in $dirsToCheck) {
    $files = Get-ChildItem -Path $dir.FullName -File
    foreach ($file in $files) {
        $fileName = $file.Name
        $fileExtension = [System.IO.Path]::GetExtension($fileName)
        if ($targetExtensions -contains $fileExtension) {
            $fileWithoutExtension = [System.IO.Path]::GetFileNameWithoutExtension($fileName); $filename.TrimEnd() -replace '\.$'
            $cmdFileName = "$fileWithoutExtension"
            $secondFile = Join-Path -Path $dir.FullName -ChildPath $cmdFileName
            
            if (Test-Path $secondFile -PathType Leaf) {
                Write-Host "[!] Suspicious pair detected "
                Write-Host "[*]  Original File:$($secondFile)" -ForegroundColor Green 
                Write-Host "[*] Suspicious File:$($file.FullName)" -ForegroundColor Red

                # Read and display the content of the command file
                $cmdFileContent = Get-Content -Path $($file.FullName)
                Write-Host "[+] Command File Content:$cmdFileContent"
            }
        }
    }
}
}
winrar-exploit-detect

Microsoft Sentinel: The rule below detects WinRAR being executed through cmd.exe. Any results warrant a closer look as they may indicate an active attack.

DeviceProcessEvents
| where InitiatingProcessParentFileName has @"winrar.exe"
| where InitiatingProcessFileName has @"cmd.exe"
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName
| sort by Timestamp desc

Splunk: Use this detection to find WinRAR CVE-2023-38831 execution on Microsoft endpoints.

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winrar.exe `windows_shells` OR Processes.process_name IN ("certutil.exe","mshta.exe","bitsadmin.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `winrar_spawning_shell_application_filter`

Cloudflare Product Coverage

Cloudflare Email Security (CES) customers can identify FlyingYeti activity using the following detections:

• CVE-2023-38831
• FLYINGYETI.COOKBOX
• FLYINGYETI.COOKBOX.Launcher
• FLYINGYETI.Rar

Recommended Mitigations

Cloudflare suggests several steps to shore up defenses against this type of intrusion:

• Start with Zero Trust architecture fundamentals.
• Deploy Cloud Email Security to guard against phishing, BEC, and other email-borne threats.
• Use browser isolation for messaging platforms such as LinkedIn and Signal to keep them separate from the corporate network.
• Apply data loss prevention policies to monitor sensitive data moving through the network.
• Install the latest security updates for both WinRAR and Microsoft products.
• Consider blocking WinRAR archives at both the email gateway and internet traffic gateway.
• Utilize an EDR tool like CrowdStrike or Microsoft Defender for Endpoint to observe binary executions.
• Review your environment against the indicators of compromise listed below.

For deeper threat intelligence or incident support, organizations can reach out to Cloudforce One via their Customer Success manager or through this contact form.

Indicators of Compromise