IBM X-Force Discovers New Sheriff Backdoor used to target Ukraine

Author

IBM X-Force discovered a set of previously unknown malware (Sheriff backdoor) used in a cyber espionage attack against an entity within Ukraine’s defense sector in the first half of 2024. The threat actor used a popular news portal in Ukraine, ukr.net, to host the Sheriff backdoor. The modular backdoor can execute actor directed commands, collect screenshots, and covertly exfiltrate victim data using the Dropbox cloud storage API. During the investigation, X-Force identified threat activity similar to CloudWizard APT and Turla (aka ITG12), both o…