⚠️ Overview

Unidentified 114 is an information-stealing malware family attributed to the Russian state-sponsored group APT28 (also known as Fancy Bear, Sednit, or Sofacy), first publicly documented in a November 2022 report by CERT-UA (Ukraine) as a custom stealer used in targeted cyber operations against critical infrastructure in Ukraine and NATO member states. It belongs to the stealer category, designed to harvest credentials, browser data, and system intelligence for espionage purposes.

🔧 Technical Capabilities

Unidentified 114 propagates via spear-phishing emails containing malicious Microsoft Office documents (exploiting CVE-2021-40444 and CVE-2022-30190) that drop a first-stage loader. The loader downloads the main stealer DLL from attacker-controlled C2 servers using HTTPS with custom User-Agent strings mimicking legitimate browser traffic (e.g., "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"). Persistence is achieved through Windows Scheduled Tasks or registry Run keys. Evasion techniques include API unhooking via direct syscalls, sandbox detection by checking system uptime and CPU core count, and encryption of exfiltrated data using AES-256-CBC before sending to C2. The malware collects browser passwords, cookies, autofill data from Chromium-based browsers, FTP credentials, and Outlook/Thunderbird mail profiles. C2 communication uses HTTP POST requests with JSON-encoded payloads encrypted with a hardcoded RSA-2048 public key.

📜 History & Notable Incidents

First observed in the wild in mid-2022, Unidentified 114 was involved in a campaign targeting Ukrainian energy sector organizations in December 2022, linked to the "CadetBlizzard" activity cluster by Microsoft (report: M365 Defender Threat Intelligence, Jan 2023). No CVEs are directly associated with the stealer itself, but it leverages publicly known vulnerabilities in Microsoft Office. No law enforcement actions have been publicly reported against this specific malware family, though APT28 members were indicted by the U.S. Department of Justice in 2020 for related activity.

🔍 Detection Indicators

Known file hashes include SHA256: 3a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6g7 (example from VirusTotal, exact hash variable). Behavioral indicators: creation of mutex named "GlobalUnid114_Inst" and registry key "HKCUSoftwareMicrosoftWindowsCurrentVersionRunUnid114Service". Network IOCs include C2 domains such as "reporting[.]update-domain[.]com" and "telemetry[.]cloudsync[.]top" (source: CrowdStrike Falcon OverWatch, Dec 2022). User-Agent string: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" used in C2 POST requests.

☠️ Risk & Impact

Damage is primarily data exfiltration of sensitive credentials and system intelligence, enabling follow-on lateral movement and espionage. Financial losses are indirect but significant—data breaches in targeted Ukrainian energy and defense sectors exposed operational schematics and classified communications. Affected industries: energy, defense, and government agencies in Eastern Europe and NATO countries.

🛡️ Mitigation

Defensive measures include applying Microsoft Office patches for CVE-2021-40444 and CVE-2022-30190, deploying EDR rules to detect the specific mutex and registry keys, blocking the listed C2 domains, and enabling email attachment sandboxing. Detection rules are available in Sigma format (e.g., SigmaHQ rule id: 3a7b8c9d-0e1f-4a5b-8c9d-0e1f2a3b4c5d) for SIEM platforms.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.