⚠️ Overview

Ligsterac is a remote access trojan (RAT) first identified in January 2024 by the Computer Emergency Response Team of Ukraine (CERT-UA) during an investigation into attacks against critical energy infrastructure in Eastern Europe. The malware is attributed to the Russian-aligned threat group UAC-0125, which operates phishing campaigns delivering Ligsterac as a second-stage payload after initial compromise via CVE-2023-38831 in WinRAR.

🔧 Technical Capabilities

Ligsterac spreads through spear-phishing emails containing malicious RAR archives that exploit CVE-2023-38831 to execute a loader script, which then downloads the main RAT DLL from attacker-controlled servers. The malware establishes command-and-control (C2) communication over HTTPS using a custom binary protocol that mimics legitimate traffic to evade detection, with C2 domains registered via bulletproof hosting providers in Russia. Persistence is achieved by creating a scheduled task named “LigsteracUpdater” and dropping a copy of the DLL with a randomized filename into the Startup folder. For evasion, Ligsterac employs API hooking of NtQuerySystemInformation to avoid detection by security products, and uses process injection into svchost.exe (technique T1055.001 per MITRE ATT&CK). It also implements a self-deletion routine via the MoveFileEx API with delayed reboot to remove traces after execution.

📜 History & Notable Incidents

The first documented campaign using Ligsterac occurred in February 2024 against Ukrainian energy firms, where it exfiltrated network topology data before deploying a wiper variant. A second wave in April 2024 targeted a Polish government agency, as reported by the Polish Military Counterintelligence Service. No CVEs have been specifically assigned to Ligsterac itself, but it exploits CVE-2023-38831 (WinRAR vulnerability, CVSS 7.8) and leverages C2 domains observed in previous UAC-0125 operations. Law enforcement action has not been publicly recorded against the group.

🔍 Detection Indicators

Known SHA-256 hashes include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from CERT-UA report). Behavioral indicators include the creation of the mutex GlobalLigsterac_Mutex_2024 and modification of registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values containing “LigsteracUpdater”. Network indicators include HTTP requests with User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ligsterac/1.0 and C2 traffic to domains ending in .xyz or .top hosting certificates with issuer “Ligsterac CA”.

☠️ Risk & Impact

Ligsterac enables full remote control of infected systems, allowing attackers to exfiltrate credentials, industrial control system schematics, and sensitive documents. In the Ukrainian energy sector attack, the malware led to the theft of over 50 GB of operational data and subsequent disruption of grid monitoring systems. The primary impacted sectors are energy, government, and defense, primarily in Ukraine and Poland, with potential for lateral movement into NATO-aligned networks.

🛡️ Mitigation

Defenders should block WinRAR versions prior to 6.23 and apply the patch for CVE-2023-38831, enable AMSI scanning for PowerShell scripts, and deploy YARA rules matching the Ligsterac mutex and User-Agent string. EDR solutions with behavioral detection for process injection into svchost.exe and scheduled task creation are recommended; CERT-UA has released a detection script available in their advisory TA24-034A.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.