Full Report
Key Targets. Industries Affected. Geographical Focus. Infection Chain – Operation IconCat. Infection Chain – I. Infection Chain – II. Campaign-Analysis – Operation IconCat. Campaign-I Initial Findings. Looking into the malicious PDF File. Technical Analysis. Malicious PyInstaller implant – PYTRIC Campaign-II Initial Findings. Looking into the malicious Spear-Phishing Outlook File. Technical Analysis. Malicious Word Document. Malicious […] The post UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting Israel appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Threat Actor: UNG0801 (Unknown-Clusters)
## Attribution & Identity
* **Identification:** Unknown-Clusters [UNG0801].
* **Origin:** Believed to originate from Western Asia.
* **Associations:** Linked by a shared playbook centered around AV icon spoofing, suggesting a shared operator or playbook across multiple campaigns (Operation IconCat).
## Activity Summary
UNG0801 has been tracked conducting activity since at least the third week of November 2025. The activity encompasses at least two distinct infection chains grouped under the umbrella of **Operation IconCat**. The overall focus is on persistent intrusion into enterprise environments, using sophisticated social engineering coupled with malware delivery.
## Tactics, Techniques & Procedures
* **Initial Access (T1566.001, T1566.002):** Rely heavily on spear-phishing attachments (PDF, Word documents) and spear-phishing links (linking to Dropbox for download).
* **User Execution (T1204.002):** Socially engineering victims to manually open the malicious documents/files.
* **Defense Evasion (T1036.005):** Significant reliance on **Antivirus Icon Spoofing**, specifically abusing branding from vendors like Check Point and SentinelOne to mask malicious files/decoys.
* **Execution (T1059.006, T1059.005):** Utilizes Python (PyInstaller) in Campaign I (**PYTRIC**) and Visual Basic (VBA macros) in Campaign II.
* **Execution/Defense Evasion (T1047):** The RUSTRIC implant (Campaign II) is executed via WMI (`Win32_Process.Create`).
* **Discovery (T1518.001):** RUSTRIC actively enumerates 28 different antivirus and EDR products by checking known file paths and processes.
* **Command & Control (T1105, T1071.001):** Retrieves secondary payloads (e.g., Campaign I retrieving malware from Dropbox) and communicates over standard web protocols.
## Targeting
* **Sectors:** Information Technology and Managed Service Providers, Human Resources and Staffing Services, Software Development and Technology Companies.
* **Geography:** Israel.
* **Victims:** A certain set of organizations within the targeted jurisdictions of interest (enterprise environments).
## Tools & Infrastructure
* **Malware Families:**
* **PYTRIC:** A Malicious PyInstaller implant observed in Campaign I.
* **RUSTRIC:** A Malicious Rust Implant observed in Campaign II.
* **Infrastructure/Delivery:**
* Initial lures delivered via malicious PDF (`help.pdf`) and Word documents.
* Download link for Stage 2 payload hosted on `hxxps://www[.]dropbox[.]com/...` (Defanged)
* Observed C2/Host: \`stratioai[.]org\`
* Observed IP: `159[.]198[.]68[.]25` (Defanged)
## Implications
UNG0801 presents a targeted threat, likely state-sponsored or highly resourced, demonstrating persistence, strong tradecraft in social engineering specific to the locale (Hebrew language lures), and evolving backends (switching from Python-based to Rust-based implants). Their obsession with AV icon spoofing highlights a focused effort to bypass user scrutiny in security-conscious enterprise environments.
## Mitigations
* **Analyze User Behavior:** Implement strict policies regarding manual execution of downloaded files, particularly those disguised as security tools or routine updates.
* **Email Filtering:** Enhance filtering against spear-phishing using attachments (PDFs, DOCX) and links that redirect to cloud storage services (Dropbox).
* **Endpoint Hardening:** Monitor for suspicious process execution via WMI (`wmic`) and script interpreters (Python/VBA).
* **Detection:** Specifically create detections for known malware behaviors, such as the specific discovery techniques used by RUSTRIC to enumerate AV/EDR products.
* **Icon Analysis:** Endpoint security solutions should perform rigorous checks on file metadata and execution origins, irrespective of visual icon conformity.