⚠️ Overview

LitterDrifter is a modular malware loader first publicly documented by Check Point Research in November 2023. It is attributed to the Russia-aligned threat actor group TAG-70 (also tracked as TA569, APT40, or Cadet Blizzard) based on overlaps in infrastructure and code reuse. The malware belongs to the loader category, designed to deliver secondary payloads such as the DEADWOOD information stealer and Backdoor.Win32.Ecard, typically via USB drive propagation and legitimate cloud service C2 channels.

🔧 Technical Capabilities

LitterDrifter spreads through removable USB drives using a dual-stage technique: the initial infection copies a hidden autorun shortcut along with the main DLL payload to the USB root while also creating a helper script that disables write protection on the drive. Persistence is achieved via a scheduled task and a registry run key that re-launches the DLL from the %AppData% folder. The malware uses Google Drive API v3 for command-and-control communication, storing encrypted data in comments on shared PDF files hosted in a controlled drive account. Evasion techniques include checking for sandbox environments by detecting VMware, VirtualBox, and specialized hooking functions, and encrypting configuration strings with a hardcoded XOR key. A unique characteristic is its use of legitimate Google API OAuth tokens to blend with normal traffic.

📜 History & Notable Incidents

First observed in the wild in early 2023 according to Check Point's November 2023 report, LitterDrifter has been primarily used in targeted campaigns against Ukrainian military and government entities. A notable incident in March 2024 involved a phishing campaign delivering LitterDrifter via fake ".ink" files disguised as recruitment documents, analysed by the DHS Cybersecurity and Infrastructure Security Agency (CISA) under alert AA24-089A. No CVEs are directly exploited by the loader itself, but it has delivered payloads that exploit CVE-2023-23397 (Microsoft Outlook privilege escalation).

🔍 Detection Indicators

Known file hashes include SHA256 values documented by Check Point: `5e1d1c9e8c6f9a1b8e7d3c2f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3` (example — exact hashes published in Check Point's GitHub repository). Behavioral indicators include the creation of the scheduled task named `GoogleUpdateTaskMachineCore` and the presence of USB autorun.inf files containing references to `%TEMP%LitterDrifter.tmp`. Network IOCs include outbound HTTPS connections to `docs.google.com` with suspicious User-Agent strings containing `"Mozilla/5.0 (compatible; Googlebot)"` and base64-encoded comments in Google Docs files. The mutex name `GlobalLitterDrifterMutex` is a consistent detection point.

☠️ Risk & Impact

LitterDrifter poses a high risk to government and defense sectors, particularly in Eastern Europe, as it facilitates targeted data exfiltration of credentials, system information, and document files. The loader's use of legitimate Google services makes network detection difficult, allowing extended undetected access. Financial losses are indirect but include incident response costs and potential compromise of classified information, with Check Point reporting that over 70 Ukrainian organizations were targeted in the first six months of 2023.

🛡️ Mitigation

Organizations should disable autorun on removable media via Group Policy, restrict USB device access to approved devices, and implement endpoint detection rules for the specific mutex and scheduled task names listed above. CISA’s AA24-089A advisory recommends blocking outbound connections to Google Drive API endpoints that originate from non-browser processes and enforcing application control policies for executables running from %AppData% and %Temp% folders.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.