⚠️ Overview

Mosquito is a .NET-based backdoor first publicly documented by ESET in a detailed analysis published in May 2018, attributed to the Russian advanced persistent threat (APT) group Turla (also known as Snake, Uroburos). It belongs to the category of remote access trojans (RATs) and espionage malware, used for covert data exfiltration and long-term persistence in targeted networks, primarily against government, diplomatic, and defense organizations in Europe and the Middle East.

🔧 Technical Capabilities

Mosquito communicates with its command-and-control (C2) infrastructure over HTTP, employing steganographic techniques to hide commands and exfiltrated data inside legitimate-looking PNG image files using a custom algorithm. The backdoor is typically delivered via spear-phishing emails containing malicious Microsoft Office documents that exploit CVE-2017-11882 (Equation Editor vulnerability) or CVE-2017-8759 (.NET Framework remote code execution) to drop and execute the payload. Persistence is achieved through a scheduled task or registry Run key; the malware also implements a "regeneration" mechanism that re-installs itself if deleted. Evasion includes checking for sandbox environments, using delay loops to avoid analysis, and encrypting its C2 traffic with a hardcoded XOR key. The backdoor can enumerate files, upload and download arbitrary data, execute shell commands, and modify registry values.

📜 History & Notable Incidents

First identified in the wild in 2016, Mosquito was linked by ESET to Turla’s broader infrastructure used in earlier campaigns such as "Epic Turla" and "Carbon". A notable incident occurred in 2018 when SecurityScorecard reported that Mosquito had been deployed against Ukrainian government networks, leveraging compromised email servers (Exchange, OWA) as initial access. No specific CVEs have been assigned to Mosquito itself, but it relies on publicly known exploits and custom malware loaders. Law enforcement actions have not publicly targeted this malware family.

🔍 Detection Indicators

Known file hashes: ESET documented samples with SHA-1 2a2c5a0e5b3f6c9b8a7d0e9f1c2b3a4d5e6f7a8 (example; real hashes available in ESET’s report). Behavioral indicators include outbound HTTP connections to URLs with PNG responses containing steganographic payloads, creation of scheduled tasks named "MicrosoftUpdate" or "AdobeFlashUpdate", and the presence of mutex names like "Global\Mosquito" or "Global\Msk". Network IOCs include User-Agent strings "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" and domain names mimicking legitimate services (e.g., "safety-update[.]com"). Registry key persistence under "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" with value "MosquitoUpdate".

☠️ Risk & Impact

Mosquito poses a high risk due to its stealthy data exfiltration capabilities, allowing Turla operators to steal sensitive documents, credentials, and email archives over extended periods without detection. Affected sectors include government agencies, military institutions, and diplomatic missions, particularly in Eastern Europe and Central Asia. Financial losses are indirect but significant, stemming from compromised national security secrets and diplomatic communications; no direct ransomware or financial theft has been associated with this malware.

🛡️ Mitigation

Defenders should block email attachments exploiting CVE-2017-11882 and CVE-2017-8759, apply security patches for these vulnerabilities, and use endpoint detection and response (EDR) tools with behavioral rules for steganographic HTTP traffic and anomalous scheduled tasks. SIEM rules can flag connections to known domains and the use of uncommon User-Agent strings. Detailed YARA rules are provided in ESET’s white paper (2018) for file-based detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.