Operation Spalax

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The Operation Spalax threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to APT-C-36, however identified enough differences to report this as separate, unattributed activity.(Citation: ESET Operation Spalax Jan 2021)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2019-11-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2019-11-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2021-01-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1588.002 · Tool

  Resource Development — For Operation Spalax, the threat actors obtained packers such as CyaX.(Citation: ESET Operation Spalax Jan 2021)

• T1583.001 · Domains

  Resource Development — For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.(Citation: ESET Operation Spalax Jan 2021)

• T1027.003 · Steganography

  Stealth — For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.(Citation: ESET Operation Spalax Jan 2021)

• T1588.001 · Malware

  Resource Development — For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.(Citation: ESET Operation Spalax Jan 2021)

• T1568 · Dynamic Resolution

  Command And Control — For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.(Citation: ESET Operation Spalax Jan 2021)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.(Citation: ESET Operation Spalax Jan 2021)

• T1059 · Command and Scripting Interpreter

  Execution — For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.(Citation: ESET Operation Spalax Jan 2021)

• T1204.001 · Malicious Link

  Execution — During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.(Citation: ESET Operation Spalax Jan 2021)

• T1566.002 · Spearphishing Link

  Initial Access — During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.(Citation: ESET Operation Spalax Jan 2021)

• T1102 · Web Service

  Command And Control — During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.(Citation: ESET Operation Spalax Jan 2021)

• T1027.002 · Software Packing

  Stealth — For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.(Citation: ESET Operation Spalax Jan 2021)

• T1608.001 · Upload Malware

  Resource Development — For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.(Citation: ESET Operation Spalax Jan 2021)

• T1497 · Virtualization/Sandbox Evasion

  Stealth, Discovery — During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.(Citation: ESET Operation Spalax Jan 2021)

• T1204.002 · Malicious File

  Execution — During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.(Citation: ESET Operation Spalax Jan 2021)

• T1566.001 · Spearphishing Attachment

  Initial Access — During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.(Citation: ESET Operation Spalax Jan 2021)

• T1218.011 · Rundll32

  Stealth — During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.(Citation: ESET Operation Spalax Jan 2021)

• T1027.013 · Encrypted/Encoded File

  Stealth — For Operation Spalax, the threat actors used XOR-encrypted payloads.(Citation: ESET Operation Spalax Jan 2021)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0005

  Official MITRE ATT&CK campaign record C0005. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.