Securonix Threat Research Security Advisory: Analysis and Detection of STEADY#URSA Attack Campaign Targeting Ukraine Military Dropping New Covert SUBTLE-PAWS PowerShell Backdoor

Threat Research

By Securonix Threat Research: D. Iuzvyk, T.Peck, O.Kolesnikov


An interesting campaign leveraging a new SUBTLE-PAWS PowerShell-based backdoor has been  identified targeting Ukraine which follows stealthy tactics to evade detection and spreads by infecting USB drives.

The Securonix Threat Research team has been monitoring an ongoing campaign likely related to Shuckworm targeting Ukrainian military personnel (tracked by Securonix Threat Research as STEADY#URSA). The malicious payload is delivered through compressed files, possibly through phishing emails. Many of the samples the team identified contained verbiage referencing Ukrainian cities, and military terminology. The attack is likely related to Shuckworm as it contains several exclusively used TTPs exclusive to the group reported in prior campaigns against the Ukrainian military.

Throughout the entire attack campaign, most of the code executed by the malware was PowerShell. The exploitation chain is relatively simple: it involves the target executing a malicious shortcut (.lnk) file which loads and executes a new PowerShell backdoor payload code (found inside another file contained within the same archive). This custom Powershell backdoor is currently being tracked as “SUBTLE-PAWS” by the team.

While the initial execution portion of the attack is quite trivial, some of the execution methods pertaining to late-stage execution and persistence are a bit more complex. We’ll cover these in detail as we analyze the script.

Initial execution: lure files and shortcuts

Of the many files the team analyzed, the overall attack pattern, and artifacts produced remained relatively consistent. Execution begins when the victim user unzips the archive and double clicks on the included shortcut file. The shortcuts followed a rather consistent nomenclature consisting of Ukrainian cities or military terms such as “ODESSA.lnk”, “CRIMEA.lnk”, “LUGANSK.lnk” or “KROPIVA.lnk”. The latter term “Kropiva” (Nettle) refers to a military system used by the Ukrainian military.

A closer look at the shortcut file shows its operation is quite simple. First, the icon is set to look like a standard video file to likely draw interest from the target. The shortcut file links directly to the powershell.exe process with a single, short argument which instructs PowerShell to run using a hidden window.

PowerShell command line is also executed which uses the Get-Content alias (gc) to read in another file (britex.was in this example) and takes the output. It then executes the output by directing it into another PowerShell process.

Figure 1: Shortcut file analysis

Second-stage execution (finance.bin)

The other included file within the archive that gets parsed and executed is another seemingly random named file such as finance.bin,, or foto.qwe for example. These files contain a single PowerShell one liner containing a single variable consisting of a large Base64 string of the SUBTLE-PAWS backdoor. This string gets decoded and executed towards the end of the script.

For some reason, in addition to decoding and executing the Base64, the attackers opted to break the script into comment-separated chunks and execute them using a For-EachObject statement and execute each under its own newly-called PowerShell process.

Figure 2: Analysis of finance.bin file executed by the shortcut

While there were quite a few analyzed secondary files, each followed an almost identical execution pattern and TTPs. For this stage of the analysis we’ll focus on the file finance.bin.

Despite its name, the finance.bin file contains the PowerShell code for the SUBTLE-PAWS backdoor script and is not a binary file. The file contains a large Base64 encoded string which when decoded, executes additional PowerShell. In addition to the .bin extension, other oddly named extensions were also identified such as ras, ps3, que, ini, cfg, was, safe and bar. Let’s break the decoded version of the script down and go over its many functions.

At the beginning of the (now) decoded SUBTLE-PAWS script, useful variables are defined. A machine identifier is generated and saved in the $name variable of the machine’s GUID. A small amount of PowerShell obfuscation is used to break up strings in order to evade detection. In subsequent sections of the code, multiple registry values are saved into “HKCU:\System“. Persistence is established by creating a new registry key at “HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” which uses an invoke expression to load and execute the “run” registry key saved into “HKCU:\System“. We’ll go over this function in detail later on.

Each key is also invoked and executed at the bottom of the script as well.

Figure 3: PowerShell SUBTLE-PAWS backdoor, registry persistence/execution

Performing dynamic analysis on the script yields our new registry key containing each “Set-ItemProperty” command found in the “Value” flag of Set-ItemProperty.

Figure 4: SUBTLE-PAWS PowerShell code injected into system registry

The PowerShell code injected into the registry performs some interesting tasks. It first attempts to establish C2 communication by first taking an IP address located at a Telegraph URL. In this case, we observed the following URL embedded into the script:


When the script parses the page, an IP address is present contained within * characters. This is set to a variable in PowerShell and used to build the C2 URL. In one example the IP is set to 185.245.184[.]146. An example of the Telegraph page can be seen in the figure below.

Figure 5: Telegraph page used to store C2 IP address

This method of retrieving a working C2 address has been used by Shuckworm in the past, for at least a year. It allows the attackers to change their working connection address on-the-fly since typically malicious C2 addresses are relatively short-lived. The Telegraph URL is controlled by the attacker, and wouldn’t be considered malicious just by itself.

In the end, it appears that the purpose of the script contained within the value of “pyrolyzing505” is simply to return the IP.

Moving to the next portion of the script, the pyrolyzing505 registry key is parsed into a variable called “$ip” which uses the PowerShell Start-Job module to parse and invoke the code from within. Some system information is gathered and built into several variables which will be used for C2 communication.

Figure 6: Build C2 URL and setup SUBTLE-PAWS backdoor communication

In an effort to improve OPSEC (Operational Security), the attackers introduced a failsafe where if the script fails to communicate with the IP over HTTPS, the script forcefully removes itself, though it would appear that the registry objects would remain intact.

SUBTLE-PAWS PowerShell backdoor overview

The rest of the Powershell backdoor script contains additional individual PowerShell functions which are represented as their own registry key. In many cases, specific functions will call other keys/functions to perform specific tasks. Here is a breakdown of each registry key name or function name and its purpose:

  • [executer] contains two functions:
    • [decod] Simply decodes data. It takes two parameters, a byte array, and a key, performing an XOR operation with the key.
    • [executer] It first calls [decod] to decode the payload and then converts it to a UTF-8 string. The function uses a COM object “MSScriptControl.ScriptControl.1” to execute the code as VBScript. Next, the script is executed as a separate job.
    • Calling mechanism:
      • The script is triggered by a condition where if a certain response ($Uri) starts with a specific flag ($flag), it executes a piece of code directly.
      • If the response does not start with the flag, it retrieves a value from a registry key (HKCU:\System\executer), the encoded payload, and then calls the [executer] function with the payload and a set of keys ($serials).
  • [run] This creates a new directory located in “$env:localappdata\Winword“. It also creates an infinite loop inside a while($true) statement which performs the following actions:
    • Sets the current directory to the user’s home directory to the current directory
    • Retrieves and executes code stored in the registry under the key HKCU:\System\softwareenvironment816
    • Retrieves and executes code stored under the key HKCU:\System\search
    • Sleeps for a random duration between 450 and 600 seconds
  • [prepare-lnk] Used to create a .lnk file. This takes its file name “finance.bin” and generates a shortcut file containing one of the following names: “Kropiva”, “arta”, “Password”. It then saves it and executes it as a background job.
  • [save] this function works with the [executer] function to execute commands on the host. This function takes two arguments and returns their bitwise XOR. Executed code is encoded using a key and presented in Base64 in an effort to hide the original commands.
  • [search] Establishes lateral movement by creating a .lnk file in all mounted drives to execute malicious registry keys. It uses the [prepare-lnk] function to build the shortcut.
  • [segmenttable453] This function uses an interesting approach for determining a remote C2 server’s IP address and performs the following actions:
    • Defines a path to the file “ps3.bin” in the local application data directory under a folder named “Winword
    • The PowerShell variable $ambush828 is created which initializes an empty string variable, which will later hold the determined IP address or domain name.
    • Check the major version of the OS. If it’s less than or equal to 7 (Windows 7 or older), it performs a DNS query using a randomly generated domain under the guvalas[.]ru domain.
    • For Windows OS versions greater than 8, it attempts to use curl to fetch content from a specified telegram URL. For lower OS versions, it uses “MSXML2.XMLHTTP” to perform an HTTP GET request to the same URL. The script then tries to parse the response to extract an IP address or domain name.
    • If the previous methods fail to yield a result ($ambush828.Length -lt 10), the script tries to use nslookup to resolve a randomly generated domain name for a TXT record by using a random running process on the system. If this still doesn’t work, it makes another DNS query using a randomly generated domain under guvalas[.]ru using the “Get-Random” PowerShell module
    • The script writes the final result ($ambush828) to the file ps3.bin. (This is another saved copy of SUBTLE-PAWS.)
    • Lastly, the function returns the result, which is expected to be an IP address used for C2 communication.
  • [SetLink] Uses COM objects for creating shortcuts containing PowerShell code.
  • [softwareenvironment816] This first checks for the presence of a file “$env:localappdata\Winword\ps3.bin“. If it is present, it reads the content of the file into $ip. If not, it starts a background job to execute code retrieved from a registry key. [pyrolyzing505]. Other functions include:
    • A unique identifier is created by concatenating the computer name and the converted serial number of the victim’s machine.
    • The function constructs a URL to communicate with. It uses HTTPS for systems with an OS version greater than 7, otherwise, it defaults to HTTP.
    • Connection to a remote PHP script is established. The script then uses a COM object (Msxml2.ServerXMLHTTP.3.0) to send an HTTP POST request to the constructed URL, including the unique identifier as data.
    • The script checks the response from the server. If it gets a 404 status (page not found), it deletes the ps3.bin file.
    • If the response ($Uri) starts with a specific flag ($flag), it executes the content following the flag. If the response doesn’t start with a specific flag, it retrieves and executes code from another registry key [executer]
    • Uses Try/Catch to issue an HTTP request, if a 404 response is detected, it deletes the ps3.bin file.

It’s important to note that the lateral movement portion of this attack does not attempt to access the target’s network. For the Ukraine military, much of their systems rely on air-gapped communications such as Starlink. Lateral movement for the STEADY#URSA campaign relies solely on the use of USB drives in an attempt to deliver and spread the malware from system to system.

AV evasion and obfuscation

Many of the individual PowerShell functions found within SUBTLE-PAWS contained within the registry values strange behaviors which are likely put in place to evade AV detections. For example, the SetLink function contains the following PowerShell code:

$a = 0;
While ($a -le 500){

$name = (Get-ItemProperty registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\ -Name MachineGuid).MachineGUID;


The loop While ($a -le 500) { … } appears to be a form of obfuscation or delay tactic. It repeatedly retrieves the MachineGUID from the registry which is stored in the $name variable but doesn’t use it. This was likely put in place to confuse analysis or delay execution in an effort to bypass heuristic detections.

Long sleeps are also used in an effort to delay execution. For example in the “save” function we see a bit of randomness being used:

start-sleep $(Get-Random -Minimum 450 -Maximum 600);

Lastly, certain strings were broken apart and split into smaller strings that might typically be flagged by AMSI or other AV detections. Most of these were contained within the initial first few lines. This type of PowerShell is overall quite common across all kinds of malware-based scripts.

Wrapping up…

The PowerShell payloads and backdoors used in the STEADY#URSA campaign show some similarities to prior Shuckworm activity. However it is clear that the tactics have shifted significantly since reports last year. In a nutshell, the primary capabilities of this backdoor malware include:

  • Dynamic execution and persistence: The SUBTLE-PAWS backdoor uses advanced techniques to execute malicious payloads dynamically. They store and retrieve executable PowerShell code from the Windows Registry which can assist in evading traditional file-based detection methods. This approach also aids in maintaining persistence on the infected system, as the malware can initiate itself again after reboots or other interruptions.
  • Command & Control: The backdoor malware is designed to establish communication with a remote server for C2. It employs various methods to determine the server’s address, including DNS queries and standard HTTP requests to dynamically stored IP addresses using Telegram. This shows adaptability to different system configurations and network environments.
  • Propagating through removable media: Part of the malware’s functionality includes spreading itself through removable attached drives such as flash drives or removable hard drives. It creates malicious shortcuts on these drives, potentially infecting other systems when these drives are spread around from system to system.
  • Stealth and obfuscation: Throughout each of the PowerShell functions, there are numerous indications of attempts to operate stealthily. This includes the use of Base64 and XOR encoding for obfuscation, randomization techniques such as random sleep intervals to avoid pattern recognition. These features make the malware more elusive and harder to detect using conventional security tools.
  • Environment sensitivity: The malware demonstrates an awareness of the operating system environment, adjusting their behavior based on the detected OS version. This sensitivity ensures that the malware can operate effectively across a range of Windows targets.

The code used throughout the attack chain represents functional backdoor malware based in PowerShell with capabilities for self-persistence, stealth, network communication, and spreading across devices. The level of sophistication suggests that the threat actors are continuing to evolve tactics to run as stealthily and effectively as possible to target systems.

Securonix recommendations

Always be extra cautious downloading file attachments from email, or from less-reputable areas of the internet, especially if the source is unknown. Be wary of how shortcut files work and how to detect them to prevent unintended code execution. When it comes to prevention and detection, the Securonix Threat Research Team recommends:

  • Avoid downloading files or attachments from unknown sources, especially if the source was unsolicited.
  • Monitor common malware staging directories, especially script-related activity in world-writable directories such as %APPDATA%
  • Deploy additional process-level logging such as Sysmon and PowerShell logging for additional log detection coverage.
  • Securonix customers can scan endpoints using the Securonix hunting queries below.

C2 and infrastructure

C2 Address Description

Used for making DNS queries under randomly generated subdomains

Used to retrieve C2 address
Backdoor C2 communication


Tactics Techniques
Defense Evasion T1027: Obfuscated Files or Information

T1027.010: Obfuscated Files or Information: Command Obfuscation

T1070.004: Indicator Removal: File Deletion

T1140: Deobfuscate/Decode Files or Information

Execution T1059: Command and Scripting Interpreter

T1059.001: Command and Scripting Interpreter: PowerShell

T1204.001: User Execution: Malicious Link

Persistence T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Command and Control T1132.001: Data Encoding: Standard Encoding

T1573: Encrypted Channel

Lateral Movement T1091: Replication Through Removable Media

Relevant provisional Securonix detections

  • PSH-ALL-228-RU
  • EDR-ALL-934-RU
  • EDR-ALL-1098-RU
  • EDR-ALL-1274-RU

Relevant hunting/spotter Queries

(remove square brackets “[ ]” for IP addresses)

  • index=activity AND rg_functionality=”Next Generation Firewall” AND destinationaddress IN (“185.245.184[.]146″,”195.133.88[.]136″,”81.19.140[.]172″,”85.159.228[.]101″,”89.185.84[.]203″,”92.118.112[.]195”)
  • index=activity AND rg_functionality=”Firewall” AND destinationaddress IN (“185.245.184[.]146″,”195.133.88[.]136″,”81.19.140[.]172″,”85.159.228[.]101″,”89.185.84[.]203″,”92.118.112[.]195”)
  • index=activity AND rg_functionality=”Web Proxy” AND destinationaddress IN (“185.245.184[.]146″,”195.133.88[.]136″,”81.19.140[.]172″,”85.159.228[.]101″,”89.185.84[.]203″,”92.118.112[.]195”)
  • index = activity AND rg_functionality = “Microsoft Windows Powershell” AND message CONTAINS “setRequestHeader” AND message CONTAINS “User-Agent”
  • index = activity AND rg_functionality = “Microsoft Windows Powershell” AND (message CONTAINS “Kropiva” OR message CONTAINS “softwareenvironment816” OR message CONTAINS “segmenttable453”)
  • index = activity AND rg_functionality = “Microsoft Windows Powershell” AND (message CONTAINS “gc ” OR message CONTAINS “Get-Content “) AND message CONTAINS “|” AND message CONTAINS ” – ” AND message CONTAINS “Out-String” AND message CONTAINS “powershell”
  • index = activity AND rg_functionality = “Microsoft Windows Powershell” AND (message CONTAINS “sajb ” OR message CONTAINS “Start-Job”) AND (message CONTAINS “gp ” OR message CONTAINS “Get-ItemProperty”) AND (message CONTAINS “iex ” OR message CONTAINS “Invoke-Expression”) AND (message CONTAINS “HKCU:\” OR message CONTAINS “HKLM:\”)
  • index = activity AND rg_functionality = “Endpoint Management Systems” AND (deviceaction = “File created” OR deviceaction = “File created (rule: FileCreate)”) AND customstring49 CONTAINS “\AppData\Winword\”
  • index = activity AND rg_functionality = “Endpoint Management Systems” AND (baseeventid = “12” OR baseeventid = “13” OR baseeventid = “14”) AND transactionstring5 = “SetValue” AND ((customstring47 CONTAINS “\System\pyrolyzing505” OR customstring47 CONTAINS “\System\softwareenvironment816” OR customstring47 CONTAINS “\System\prepare” OR customstring47 CONTAINS “\System\run” OR customstring47 CONTAINS “\System\save” OR customstring47 CONTAINS “\System\search” OR customstring47 CONTAINS “\System\SetLnk” OR customstring47 CONTAINS “\System\executer” OR customstring47 CONTAINS “\System\result_code”) OR (customstring47 CONTAINS “\System\” AND (customstring48 CONTAINS “Get-ItemProperty” OR customstring48 CONTAINS ” -bxor ” OR customstring48 CONTAINS “MSXML2.XMLHTTP”)))

Analyzed files/hashes

TELEGRAM.lnk 252A6736420862DB7A275A16F5C3D4F3E51784244CCF72FCFA30236439D834C8
SIGNAL.lnk 61370D0AC56F73321C11876424EC75E2740D6910FF53B0791F0560C72D85B330
session.bin 2861CE32762327228F9875643AB253E2C2B04565739B65919D2AFDDE405A9AEA
safe.ps3 D222977AB20317647595C9DE7413BD17A8074006007150102AA2B569FC2CCBF1
safe.lag 3A4C14D0745FC97839F904BACB8B42FD9EB620D736A29C08841A2E9C0E488D3B
root.ini 6DDED7FC8B22BFCE6F7C548D75B20F01586D348982788626178D48C72D705E26
PORNOHAB.lnk EEC752C82A84C1A5BC949FDD6FE23D70C8837A03184AA89A1E9698C730A51582
OTU.lnk B22E3F12A8C41096D83DA3F9E04931AFE60A7BB182261861569858E3D50967CA
ODESSA.lnk 8F9AD0AD2BA5499CAF098C3DC055888883D1268257CF923A380E7C3460F1C63D
NEWFOLDER.lnk C44ACD1B6961D585E89366D0FE0C2DAC3FD6103318EC8FEBA3E4926C85B85A02
MUSIC.lnk 7C480891587F22CD8592CC4E9DD2F10D907E02CF46D6B4C188ADB13669AB3AEC
MAP.lnk 3BC1AFED855DBD8C729C50A74DFE01164673941DDF8DCAF4402D9B23EDC2F2CC
LUGANSK.lnk 8ECE5D5C77C3A03B50C756F39B9212956143B969223318530A8DBB9F3D9F5F3D


LIMAN.lnk 029C0F4C44DA0733EC6455ABDD120FABA7FC7989489C3FE7CEC86C25BAD3E572
KROPIVA.lnk D7E228473690FEC029A0204FEB2AE58504A869C86686194B8034C21718A55BE7



grawer.ras 5856E52224EC2C7D322FE28E207A8AEF5D7B69032ED060FBD1EAD7331F67A004
grawer.ps3 9D1F858D2325A27944A21387B78FA3957B904325350E580E8DE5255AA650CB1D


foto.qwe 6EDC9B3FF9F69E86919D80B513E7CA4C93AC0DC03D6E40F85A8703FF49DA2758
firm.was 8102995258F1D800A76273213AE57B3A320CBAFED491C101DB5EB7B191CE53D7
finance.ras 3063D671609088BB518FF69FDEC337EDD1BA5626BD427E03ED8D9D0F8EA4F14F
finance.log 79C2038B401391923C4253A5409AE537E8D397C8DFE8510B9C467BE78CA04F59
finance.ini 5302E764A9638D86F787137ED02D6C59A4E1E6AA2E7BEE27EC91653C83E3127A
finance.bin 2F0375BB6A732010D0082F0F44F74D6A641E0A61C9F77D7922A15597CDA6A1CD
DONECK-SHTAB.lnk 7A925D78C3B0F30B16EE358EEC51F2A6439027BDF37B1C840DBC49FF1B224054


DELTA.lnk AA01B0CC318286ED4DB10B23D2A3CD27482EF2B0DF794234F62E2D59CFC67336
CRIMEA.lnk 920BD70612E63C673CE3B84B4A1FC7319C2FB01FA940D8A269429FF8FDD5D018

17752B3F3B452ACAF372108CC233CA67790FF62716916A9B84B4E3EF31E89883 ED891F921F379916F6119C32DAFD068B13B216D11AB8F212BD309EF39F24D0DE
create.ini 462BE856BF70BC25DF2A694825D99B97453F117100A3309DF3C03B1FC60EAA61
company.qwe EC6283E87ABC73CDF0AF2120A77EA3140904B261D61782369B9A25431AEE9EBF
company.cfg 52B7243B9C07A51DABB3DC69216ADB6E277ACFFA827D2599C68C331ADEE8FEAF
britex.was BF754818C4033247F645C66E7A61E6E755795982339E74011857C79EF17F391D 5E7AAD698DC49213CE6C9A1B2DCFCCC3F42769855D5169D41BAF99B46D405AD0
britex.bin C0A01267184FC943D6C5D373341FD495ECF6D69154343E3980A11635446D522F


02459F35033D241A71124051153890CA8D3470AEBCE07446CF6E16D5757B51F1 6CAD4614E91980AF16F9057764F98FB44CA2FA99DDCFF46B76297B3C8CD0BE0
BELARUS.lnk 4EC3682BC45036A0C48C01208EC1FB07B8AF6D9F03AC803A51B34876B3BE245E
BANK.lnk B257088C0D3CA65F3A3BDA1B8CECF942D0967F3591E182EC32474737AB6BF3C6


ARTA.lnk 5460CBEBC25FE4C856AFC5089702AFAA90EDCBC25C4980E021D1C59BF4E059EA


  1. Shuckworm: Inside Russia’s Relentless Cyber Campaign Against Ukraine
  2. Securonix Threat Research Knowledge Sharing Series: Hiding the PowerShell Execution Flow
  3. How LNK Files Are Abused by Threat Actors