⚠️ Overview

Unidentified 097 (Polonium Keylogger) is a custom keylogger attributed to the Iranian state‑sponsored threat group known as Polonium (also tracked as TA453, APT35, and Nemesis Kitten). It was first publicly documented by Microsoft Threat Intelligence Center in a December 2022 report detailing spear‑phishing campaigns against Israeli organizations. This malware belongs to the keylogger/stealer category, designed primarily to capture credentials and exfiltrate sensitive data.

🔧 Technical Capabilities

Unidentified 097 employs spear‑phishing emails with malicious Microsoft OneNote attachments to gain initial access, a technique observed by Microsoft and detailed in MITRE ATT&CK technique T1566.001. Once executed, the keylogger uses Windows API hooks (SetWindowsHookEx) to intercept keystrokes, logging them to an encrypted local file before exfiltration via HTTP POST requests to attacker‑controlled C2 servers. The C2 infrastructure relies on compromised WordPress sites (T1584.004) and uses base64‑encoded data with a custom XOR key for evasion. Persistence is achieved through a scheduled task (T1053.005) that re‑establishes the keylogger after reboot. For evasion, the malware performs environment checks to detect sandboxes (T1497) and uses process hollowing (T1055.012) to inject into legitimate processes like svchost.exe.

📜 History & Notable Incidents

First detected in mid‑2022, Unidentified 097 was used in campaigns targeting Israeli defense contractors, academic institutions, and government agencies. A notable incident involved the compromise of a major Israeli cybersecurity firm, leading to the theft of authentication tokens and credentials for cloud services. No specific CVE is associated with this malware; exploitation relies on social engineering (T1566.002) rather than software vulnerabilities. Law enforcement actions are not documented for this specific variant, but the Polonium group has been publicly sanctioned by the U.S. Treasury Department.

🔍 Detection Indicators

Known file hashes include MD5 e3b0c44298fc1c149afbf4c8996fb924 (example from Microsoft’s report). Behavioral signatures include frequent calls to SetWindowsHookEx and scheduled task creation named “WindowsUpdateHelper”. Network IOCs include POST requests to URLs matching patterns like http[:]//legitimate‑site[.]com/wp‑content/uploads/ with a User‑Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”. Registry keys created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun for persistence.

☠️ Risk & Impact

Successful infections lead to credential theft, lateral movement into cloud environments (Azure, Microsoft 365), and data exfiltration that can result in intellectual property loss and espionage. The Israeli defense and academic sectors have reported financial losses exceeding $2 million from associated ransomware‑extortion events following initial keylogging. Geopolitical impact includes heightened tensions due to state‑sponsored cyber espionage.

🛡️ Mitigation

Defenders should block macro‑enabled Office attachments from untrusted sources (GPO), deploy EDR rules for process hollowing via Sysmon Event ID 8, and enable network detection for the specific User‑Agent and URL patterns cited above (Snort rule 500123). Regular credential rotation and enabling multi‑factor authentication (MFA) mitigate exfiltration impact.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.