The Art of Cyberwarfare

Group-IB analyzes Webdav-O, a WebDAV-based RAT that uses Yandex.Disk for C2, and links x86 and x64 samples to the BlueTraveller (RemShell)/TaskMasters family and to Albaniiutas/TA428 variants; the report provides sample metadata, command behavior, RC4 keys, file and cloud-path IoCs, network indicators, YARA rules, and argues that these tools were used in targeted espionage campaigns against Russian federal executive authorities in 2020.