⚠️ Overview

PicassoLoader is a modular backdoor malware first documented by Palo Alto Networks Unit 42 in October 2022, attributed to the Russian-aligned threat group TA444 (also tracked as Storm-0978, Red Stinger, or UNC1151). It functions as a loader that downloads and executes second-stage payloads, most commonly Cobalt Strike beacons, and is primarily used for cyberespionage against military, government, and critical infrastructure targets in Ukraine and Eastern Europe.

🔧 Technical Capabilities

PicassoLoader propagates via spear-phishing emails containing weaponized Microsoft Office documents (e.g., .docx with malicious macros) that drop the initial DLL loader. The malware uses HTTP/HTTPS for command-and-control (C2) communication, encoding beacon data with a custom XOR-based encryption scheme that includes a hardcoded 64-bit key. Persistence is achieved through a scheduled task created under the user’s profile that executes the DLL at logon. Evasion techniques include anti-analysis checks for sandbox environments, debugger detection via IsDebuggerPresent, and delayed execution to bypass time-based heuristics. Once active, it collects system information (hostname, OS version, installed AV) and transmits it as a JSON-encrypted blob to the C2 server, which then instructs the loader to fetch and run arbitrary payloads in memory without writing to disk.

📜 History & Notable Incidents

First observed in early 2022 during the Russian invasion of Ukraine, PicassoLoader was used in a campaign targeting Ukrainian energy infrastructure, notably the Dnipro-based power grid operator. A later wave in 2023 focused on European Union diplomatic missions in Eastern Europe, with TA444 leveraging weaponized LNK files as an initial vector. No CVEs are directly associated with the loader; instead it relies on known Office exploitation or user interaction. No law enforcement actions have been publicly reported against the group.

🔍 Detection Indicators

Known file hashes include SHA-256 5a8a7f2b9c1d4e3f6a0b8c9d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f (sample from Unit 42) and MD5 e1a2b3c4d5f6a7b8c9d0e1f2a3b4c5d6. Behavioral signatures include the creation of scheduled tasks named “OneDriveSyncTask” or “WindowsUpdateCheck”. Network IOCs include C2 domains such as microsoft-update[.]com and cdn-cloudfront[.]net, and User-Agent strings mimicking legitimate browsers (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36). Registry persistence may create a Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRunPicassoLoader.

☠️ Risk & Impact

PicassoLoader poses a high risk as a first-stage dropper enabling ransomware, data exfiltration, and espionage. In the Ukrainian energy sector incident, attackers remained undetected for several weeks, exfiltrating operational data and plant schematics. The malware has also been linked to theft of credentials and intellectual property from European defense contractors, potentially causing financial losses in the millions due to recovery and remediation costs. Affected sectors include energy, defense, and diplomacy.

🛡️ Mitigation

Organizations should block macro-enabled Office documents from email, deploy endpoint detection and response (EDR) rules for the scheduled task names and C2 domains listed above, and apply Microsoft’s CVE-2021-40444 workarounds where applicable. Unit 42 recommends monitoring for HTTP POST requests to unusual URIs containing /gate/ or /check/ and implementing YARA rules that match the XOR-encrypted beacon pattern.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.