Spyware Campaign Hits Russian Industrial Firms

A Russian cybersecurity company is warning that hackers are targeting Russia’s industrial sector using a previously undocumented spyware, reeling them in with contract-themed emails lures.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Kaspersky dubbed the spyware “Batavia”, tracing the origins of the campaign to July 2024. The campaign has compromised more than 100 users at dozens of Russian organizations. The attackers use emails disguised as official contract offers to trick employees into downloading spyware that steals sensitive documents and system data.

The Moscow-headquartered company doesn’t attribute the campaign to a threat actor. (see: Looking Tough: Russia Trumpets Pro-Ukraine Hacker Arrests).

The infection begins when victims click a link embedded in a phishing message, typically referencing contract files like договор-2025.vbe, meaning contract-2025.vbe. The link serves an encrypted Visual Basic for Application script. Once executed, the script acts as a downloader, fetching additional components from command-and-control infrastructure.

The first major payload, WebView.exe gathers system logs, documents from local drives and periodically takes screenshots. It exfiltrates data to a second attacker-controlled domain, ru-exchange.com, tagging it with a unique infection ID that persists across all stages of the attack.

It also plants another payload, javav.exe, into the ProgramData folder and sets it to auto-execute at startup.

The second payload expands the list of files to exfiltrate by expanding it to include JPEGs, vector graphics, spreadsheets, emails, presentations, archives and text documents. The program also includes enhanced communication features, allowing it to receive new C2 addresses and additional malicious executables from the attacker’s server using encrypted data and XOR-based obfuscation.

To launch additional payloads, javav.exe employs a known user account control bypass technique involving manipulation of the Windows Registry and the computerdefaults.exe utility. This allows the final stage binary, windowsmsg.exe, to be executed without triggring security prompts. While the last-stage payload was unavailable at the time of analysis, Kaspersky suspects it serves as a modular extension for further surveillance or exfiltration.