Cracked by the GRU: how Russia's notorious Sandworm unit weaponizes pirated software usage to target Ukraine

Cracked by the GRU: how Russia's notorious Sandworm unit weaponizes pirated software usage to target Ukraine

Speakers: Arda Büyükkaya, Senior Threat Intelligence, EclecticIQ

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=_X1pGNgaKfE

Overview

In this compelling talk, Arda Büyükkaya, a Senior Threat Intelligence Analyst at EclecticIQ, unveiled how the notorious Russian state-sponsored threat actor Sandworm (also known as APT44, linked to the GRU) has systematically exploited the widespread use of pirated software in Ukraine to conduct sophisticated cyber espionage and potentially disruptive attacks. The presentation meticulously detailed Sandworm's evolving tactics, techniques, and procedures (TTPs), culminating in the discovery of a previously undocumented backdoor dubbed Calamur. Büyükkaya's research highlights a persistent and adaptable adversary, leveraging a pervasive societal issue—software piracy—as a primary vector for initial access and long-term compromise.

The talk demonstrated a clear progression in Sandworm's campaigns, from trojanized Windows installers and Microsoft Office suites to more recent abuses involving Microsoft Key Management Service (KMS) activators and impersonated anti-malware software distributed via Signal messenger. This strategic exploitation of pirated software creates a vast and readily available attack surface, particularly in regions with high rates of unlicensed software usage, such as Ukraine. The findings are critical for understanding modern nation-state cyber operations and for developing robust defensive strategies against adversaries that ingeniously blend social engineering with technical prowess.

Büyükkaya's investigation not only attributed these campaigns to Sandworm through consistent TTPs and infrastructure pivoting but also provided actionable intelligence, including specific indicators of compromise (IoCs) and detection strategies. The discovery of the Calamur backdoor represents a significant contribution to threat intelligence, offering defenders new insights into Sandworm's operational toolkit. This research underscores the vital role of proactive intelligence gathering and sharing in combating advanced persistent threats (APTs) and safeguarding critical infrastructure and government entities.

Background

▶ Watch: Sandworm's use of pirated software to target Ukraine (0:00)

The Sandworm group, formally designated as APT44 and widely linked to the Russian military intelligence unit GRU, has a long and infamous history of cyber operations. Their activities span both cyber espionage, aimed at gathering intelligence from government and telecommunications sectors, and highly disruptive attacks, famously including those against Ukraine's energy grid. Since the full-scale invasion of Ukraine in 2022, Sandworm's focus on the region has intensified, with a notable shift towards exploiting the pervasive issue of pirated software.

A critical vulnerability enabling Sandworm's campaigns is the high prevalence of unlicensed software in Ukraine. According to Microsoft, approximately 70% of software in Ukraine's state sector is unlicensed, creating an extensive and easily exploitable attack surface. Sandworm has consistently abused this weakness, employing a straightforward yet effective social engineering tactic: impersonating Ukrainian users on local forums to distribute fake, trojanized pirated software. This method has proven highly successful due to the low cost and ease of access associated with pirated software.

The evolution of Sandworm's attacks using this vector demonstrates their adaptability. In 2022, they distributed trojanized Windows 10 operating system installers targeting Ukrainian government entities. By 2023, similar tactics were observed with pirated Microsoft Office suites aimed at utility employees. A significant escalation occurred in 2025, with the identification of trojanized Microsoft KMS (Key Management Service) activation tools used to deliver malware for cyber espionage. Most recently, in June 2025, Sandworm pivoted to using Signal messenger to deliver malware disguised as an ESET anti-malware installer, further illustrating their willingness to adopt new lures and distribution channels while maintaining the core strategy of weaponizing pirated software. These campaigns consistently leverage high-usage pirated software as an initial compromise vector, underscoring a persistent and strategic approach to targeting Ukrainian entities.

Key Findings

▶ Watch: Dark Crystal RAT capabilities: keylogging, screenshots, data theft (7:00)

The research presented by Arda Büyükkaya brought to light several critical findings regarding Sandworm's operations, particularly their ingenious exploitation of pirated software and the discovery of a new malware family.

Firstly, the talk meticulously detailed the KMS update campaign, a sophisticated operation observed between 2024 and 2025. This campaign involved the distribution of a trojanized KMS activator, mimicking legitimate Microsoft activation tools. Instead of activating software, this tool delivered a loader known as Backorder. This loader's primary function was to disable Windows Defender, establish persistence by editing scheduled tasks, and then deploy a remote payload—specifically, the Dark Crystal RAT (DCRAT)—from Sandworm-operated command-and-control (C2) servers. The use of a visually convincing but fake KMS Auto interface served as an effective distraction technique for victims.

A pivotal discovery was the identification of a newer, Python-based version of the Backorder loader. Decompilation of this variant revealed Russian language commands embedded within the script, providing strong linguistic attribution to a Russian-speaking threat actor. This Python version exhibited the same core functionalities as its predecessor, including disabling Windows Defender and establishing exclusion rules, but used rundll32 for executing its DLL-based payload.

The most significant contribution of this research was the discovery of the previously unknown Calamur backdoor. This new malware was identified through meticulous infrastructure pivoting. By analyzing the C2 domains associated with the KMS update campaign, specifically KMSupdate_2023.com, researchers identified shared WHOIS registration details (PDR) and URL paths, which led to the discovery of calamur.net. This domain was directly linked to the Calamur backdoor, whose name, interestingly, is derived from a Ukrainian TV show. Calamur represents an evolution in Sandworm's toolkit, featuring distinct capabilities for long-term access and information exfiltration.

Finally, the talk highlighted Sandworm's continuous adaptation, showcasing a June 2025 campaign where Calamur was delivered via Signal messenger, disguised as an ESET anti-malware installer. This variant demonstrated enhanced capabilities, including the installation of malicious root certificates to intercept and decrypt SSL/TLS encrypted web traffic, indicating a sophisticated approach to data collection and espionage. These findings collectively paint a picture of a highly adaptive and persistent adversary, constantly refining their TTPs to achieve their objectives.

Technical Deep Dive

▶ Watch: Discovery of the previously unknown Calamur backdoor (10:00)

Sandworm's campaigns, as detailed in the talk, showcase a blend of social engineering, living-off-the-land (LOTL) binaries, and custom malware. The KMS update campaign exemplifies this approach. Victims would download a trojanized KMS activator, often from torrent sites or warez pages between 2024 and 2025. Upon execution, the activator presented a convincing, legitimate-looking KMS Auto user interface, serving as a distraction. In the background, a loader, later identified as Backorder, initiated the malicious process.

The Backorder loader was designed to perform several critical actions. It would first disable Windows Defender and then establish persistence by creating or modifying scheduled tasks. Crucially, it downloaded its remote payload, the Dark Crystal RAT (DCRAT), using curl.exe, a legitimate Windows binary, from a remote C2 server. After downloading a ZIP file containing DCRAT, Backorder would extract it to the public file directory and immediately add exclusion rules to Windows Defender for the payload's path, ensuring evasion of default security mechanisms. Artifacts of the payload were also deleted to hinder forensic analysis.

Sandworm heavily relies on Living Off The Land (LOTL) binaries for defense evasion and reconnaissance. Tools like WiiReg.exe and PowerShell.exe were observed being used to collect user information, such as whether the victim device was connected to a domain or if it was a home user, information crucial for subsequent espionage activities. The DCRAT itself is a full-featured remote access trojan, capable of extensive cyber espionage. Its capabilities include keylogging, taking screenshots, and collecting sensitive web browser data such as cookies, stored credentials, and API keys from Chrome, Firefox, and other browsers. DCRAT maintains persistence through scheduled tasks, ensuring remote access every time the victim's computer starts.

A newer version of the Backorder loader was identified as being developed in Python. Upon decompilation, this variant contained Russian language comments, offering a direct linguistic link to its operators. It replicated the core functionalities of disabling Windows Defender and adding exclusion rules, but executed its payload, a DLL, using rundll32. The consistent use of phrases like "we will change the working directory to the script directory" in the comments suggested a coordinated development effort by a team.

The discovery of the Calamur backdoor was a testament to effective threat intelligence pivoting. Researchers identified four distinct infrastructures linked to the KMS update campaign. By analyzing their shared WHOIS registrant (PDR) and similar URL paths, they pivoted from a C2 domain like KMSupdate_2023.com to calamur.net, revealing the new backdoor. The Calamur execution flow typically begins with a PowerShell script. Unlike DCRAT, Calamur's initial PowerShell script was described as having "no sophisticated evasion techniques." Its immediate objective is to transform the victim's machine into an open-access device by enabling RDP, SSH, and SMB ports. It then creates a new administrative user account, often with a consistent default password across campaigns, for logging into RDP sessions.

A key feature of Calamur is its use of the Tor network. It downloads and installs Tor Browser as a Windows service, establishing persistence and turning the victim's computer into a Tor hidden service. Communication with the C2 server occurs via a statically coded .onion site embedded within the PowerShell script. This connection is facilitated by curl.exe used with a SOCKS5 proxy, bridging the Tor hidden service to the C2 Onion site, enabling remote access via RDP, SSH (by installing OpenSSH), and arbitrary PowerShell command execution.

In a June 2025 campaign, a newer version of Calamur demonstrated further evolution. This variant was distributed via Signal messenger, impersonating ESET anti-malware software through a URL like assetpremium.com. The lure instructed users to open the URL on a computer, leading to a ZIP file download containing a fake ESET installer signed with a bogus certificate. This Calamur version exhibited an advanced capability: the installation of malicious root certificates. Using a simple PowerShell module called Import-Certificate, it installed these certificates into the victim's root directory, allowing the attackers to intercept and decrypt SSL/TLS encrypted web traffic, effectively gaining full visibility into encrypted communications.

Further infrastructure pivoting was conducted using the HTML file from the assetpremium.com campaign, which featured a copied Wikipedia Signal messenger logo, leading to three additional asset-themed infrastructures. WHOIS registration data, specifically a newly created email address using onionmail.org (an anonymized mailing service), also enabled the identification of three more domains, hinting at a broader network of Sandworm infrastructure and potentially new malware samples.

Demo / Proof of Concept

▶ Watch: Practical detection strategies using Sigma rules and EDR (18:00)

While the talk did not feature a live, interactive demonstration in the traditional sense of a proof-of-concept, Arda Büyükkaya effectively walked the audience through the observed execution flow of the malware in a simulated environment. This included visual aids showing the deceptive KMS Auto interface, the command-line execution of PowerShell scripts leveraging curl.exe for payload download, and the subsequent actions taken by the Backorder loader and Calamur backdoor. The speaker highlighted their methodology, specifically mentioning observing the execution in a virtual machine to understand the malware's behavior. This allowed for a clear exposition of how Windows Defender exclusion rules were added, how LOTL binaries were abused, and how the Tor-based communication was established. Screenshots of Sysmon logs were presented to illustrate the curl.exe activity, providing concrete evidence of the communication patterns and binary abuse, which were then used to develop detection strategies.

Defensive Implications

▶ Watch: Recommended disabling of living-off-the-land binaries (20:20)

The detailed insights into Sandworm's TTPs offer critical defensive implications for organizations, particularly those in high-risk sectors or geographies like Ukraine. The pervasive use of pirated software as an initial access vector underscores the importance of strict software licensing policies and user education. Organizations must enforce the use of legitimate, patched software and educate employees about the dangers of downloading software from unofficial sources, even if it appears to be a common utility or anti-malware solution.

Monitoring and restricting the use of Living Off The Land (LOTL) binaries is paramount. Sandworm's reliance on tools like curl.exe, PowerShell.exe, WiiReg.exe, rundll32, and scrhost.exe (for VBS scripts) means that unusual execution patterns of these legitimate tools can be strong indicators of compromise. Defenders should implement robust Endpoint Detection and Response (EDR) solutions or Sysmon to log and analyze processes, command-line arguments, and network connections made by these binaries. Specifically, curl.exe making connections to suspicious IPs or .onion services, or PowerShell.exe executing scripts that modify security settings or install services, should trigger immediate alerts. For non-high-privilege users, disabling or severely restricting the execution of certain LOTL binaries, where applicable, can significantly reduce the attack surface.

Scheduled task monitoring is another critical defensive measure, as both Backorder and DCRAT, and Calamur extensively use scheduled tasks for persistence. Any new or modified scheduled tasks, especially those executing unusual scripts or binaries, should be investigated. Furthermore, the disabling of Windows Defender or the creation of exclusion rules should be a high-priority alert.

For Calamur's Tor-based communication, organizations should implement network monitoring to detect connections to .onion services or unexpected Tor traffic, if Tor usage is not a legitimate business requirement. The creation of new administrative users, especially with default or known weak passwords, and the enabling of RDP, SSH, or SMB ports should be immediately flagged by directory services and network security tools.

The installation of malicious root certificates by the newer Calamur variant highlights the need for certificate monitoring solutions. Any unauthorized root certificate installations must be detected and revoked to prevent SSL/TLS interception.

Finally, the speaker provided actionable Sigma rules for detecting key Sandworm behaviors. These rules, which are publicly available, target curl.exe abuse in C2 communication and the alteration of Windows Defender policies. Incorporating these and similar behavioral rules into SIEM or EDR systems can significantly enhance detection capabilities against these specific Sandworm TTPs. Leveraging actionable intelligence, such as that provided in this talk, is crucial for improving threat modeling and applying new detection methods proactively.

Key Takeaways

• Weaponization of Pirated Software: Sandworm effectively exploits the high prevalence of unlicensed software in Ukraine, using trojanized installers and activation tools as a primary initial access vector. This strategy remains highly effective due to its low cost and wide reach.
• Evolution of Malware Toolkit: The research unveiled the Calamur backdoor, a previously unknown malware, which demonstrates Sandworm's continuous development and adaptation of its offensive capabilities, moving from the Backorder loader and Dark Crystal RAT (DCRAT) to more sophisticated tools with Tor-based communication and SSL/TLS interception.
• Strategic Use of Living Off The Land (LOTL) Binaries: Sandworm extensively leverages legitimate Windows binaries such as curl.exe, PowerShell.exe, and rundll32 for defense evasion, reconnaissance, payload delivery, and C2 communication, making detection challenging without deep behavioral analysis.
• Infrastructure Pivoting for Threat Intelligence: The discovery of Calamur and additional Sandworm infrastructure highlights the critical value of infrastructure pivoting—analyzing shared WHOIS data, C2 patterns, and lure themes—to uncover new threats and expand understanding of adversary operations.
• Actionable Defensive Strategies: Defenders must focus on monitoring and potentially restricting LOTL binaries, implementing robust EDR/Sysmon logging, detecting scheduled task creation, monitoring network traffic for Tor connections, and actively searching for unauthorized root certificate installations.
• Importance of User Education and Policy Enforcement: Given the social engineering aspect of these attacks, educating users about the risks of pirated software and enforcing strict software licensing policies are foundational steps to mitigate this prevalent attack surface.

About the Speaker(s)

Arda Büyükkaya is a Senior Threat Intelligence Analyst at EclecticIQ. With five years of experience in the field, Arda specializes in delivering actionable intelligence and uncovering nation-state cyber operations. His expertise lies in dissecting advanced persistent threats (APTs) and providing insights that enable organizations to enhance their defensive postures against sophisticated adversaries like Russia's Sandworm group.