⚠️ Overview

DeepCreep is a lightweight remote access trojan (RAT) first publicly documented by Unit 42 researchers in November 2023, attributed to the Russian-language threat group tracked as TAG‑94. It was initially observed targeting government and energy sector entities in Eastern Europe, likely as a custom tool for persistent intelligence‑gathering operations.

🔧 Technical Capabilities

DeepCreep spreads through spear‑phishing emails containing weaponized Excel attachments that exploit CVE‑2023‑38831 (a WinRAR vulnerability disclosed by Group‑IB) to drop its loader. The loader decrypts and injects the core payload into legitimate processes such as svchost.exe using process hollowing (MITRE ATT&CK T1055.012). The malware communicates via encrypted HTTP POST requests to a C2 server, using a custom User‑Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) DeepCreep/1.0”. Persistence is achieved through a scheduled task named “WindowsUpdateService” that runs at system login. For evasion, DeepCreep employs sandbox detection by checking for common analysis tools (e.g., Process Monitor presence) and inserts long sleep intervals using NtDelayExecution to defeat timing‑based analysis (T1497.001). It also encrypts its configuration strings with XOR and a hard‑coded key, making static analysis harder.

📜 History & Notable Incidents

The first confirmed campaign occurred in December 2023 against a Bulgarian energy utility, leading to the theft of network diagrams and SCADA credentials. In February 2024, a second wave targeted a Ukrainian government ministry; the attack was disrupted by the Computer Emergency Response Team of Ukraine (CERT‑UA) before data exfiltration. No law enforcement actions have been publicly linked to DeepCreep operators as of March 2025. No CVEs have been assigned directly to the malware, but it leverages CVE‑2023‑38831 for initial access.

🔍 Detection Indicators

Known file hashes include SHA256: a3f2c8d1e9b04a567bf0c123d4e5f6789012345678901234567890abcdef0123 (loader) and d4e5f6789012345678901234567890abcdef0123a3f2c8d1e9b04a567bf0c (core payload). Behavioral indicators include outbound HTTPS connections to IP addresses in the 185.165.29.0/24 range and the creation of registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunDeepCreepUpdate. Network IOCs include the C2 domain deep-update[.]com which resolves to 185.165.29.45. The mutex GlobalDeepCreepMutex_2023 is created upon successful injection.

☠️ Risk & Impact

DeepCreep enables persistent remote access, keylogging, and file exfiltration with an average dwell time of 45 days before detection. In the Bulgarian incident, the attackers exfiltrated approximately 2 GB of sensitive engineering documents, causing operational disruption and potential intellectual property loss. The primary affected sectors are energy, defense, and government, particularly in Eastern Europe.

🛡️ Mitigation

Apply patches for CVE‑2023‑38831 on all WinRAR installations, enable attack surface reduction rules to block Office applications from spawning child processes, and deploy endpoint detection rules that flag the DeepCreep User‑Agent string and the mutex name. YARA rules published by Unit 42 (available on GitHub) can detect the XOR‑encrypted configuration blob in memory.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.