CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK

CERT-UA reported a December 15–25, 2023 phishing campaign attributed to APT28 that used malicious links abusing the search-ms: URI to drop Windows LNK files which launch PowerShell to install a Python-based backdoor (MASEPIE), a PowerShell-based browser-data harvester (STEELHOOK), and a C# backdoor (OCEANMAP). The actors used IMAP as a control channel with Base64-encoded commands stored in email drafts, achieved persistence via a VMSearch.url placed in Startup, and performed rapid reconnaissance and lateral movement using tools like Impacket and SMBExec.