GraphicalProton

GraphicalProton is a loader/backdoor malware associated with APT29/Cozy Bear/Midnight Blizzard and attributed in the provided content to Russia’s Foreign Intelligence Service (SVR). It is also referred to as GraphDrop and SPICYBEAT. The malware has been described as a loader capable of delivering second-stage malware and as a simplistic backdoor used by SVR operators for follow-on access. Reported command-and-control behavior includes abuse of legitimate cloud services, primarily Microsoft OneDrive and also Dropbox, to exchange data with operators. The content states that data transiting these services was obfuscated inside randomly generated BMP files using compression, encryption, and pixel-bit encoding. An HTTPS C2 variant is also mentioned, including the URL hxxps://matclick[.]com/wp-query[.]php reported in December 2023. In TeamCity-related intrusions exploiting CVE-2023-42793, GraphicalProton was reportedly wrapped in multiple layers of encryption, obfuscation, encoders, and stagers, and variants were observed using DLL hijacking via the open-source monitoring tool Zabbix or hiding activity within the vcperf build analysis tool. The malware was used after SVR exploitation of unpatched, internet-reachable JetBrains TeamCity servers beginning in late September 2023, where the actors used access for privilege escalation, lateral movement, persistence, credential theft, Active Directory enumeration, disabling antivirus/EDR, and planting additional backdoors. The content ties this activity to opportunistic compromise of organizations across the United States, Europe, Asia, and Australia, including software, IT, hosting, medical device, financial management, marketing, sales, video game, and energy-related entities.