“This level of familiarity also supports our earlier finding that the actor had been using the Sarwent malware since as early as 2014. However, other methods exist through its shell and PowerShell execution capabilities.Ĭisco Talos researchers believe that the graphical user interface disguising Sarwent into an antivirus solution indicates that the threat actor behind it has access to the malware source code. It allows direct access to the machine by activating the remote desktop protocol (RDP) or via the Virtual Network Computing (VNC) system. It features functions typically seen in a remote access tool (RAT), giving its operator access to the infected machine. Sarwent is written in Delphi and it is not a frequent encounter in the wild. They also found a similar backend being used since 2014, suggesting either that the malware is much older than initially thought or that a different actor used it before. The researchers assess with high confidence that a Russian-speaking individual is responsible for the recent Sarwent attacks. “Looking at the C2 domains' volume, we can see a much narrower distribution country wise, with an even lower volume,” the researchers note in a report Today.īased on data from the administration panel of a Sarwent command and control (C2) server active during the investigation, the malware reached mostly users in the U.K. It is unclear how the actor lures visitors to the fake Amnesty International website but an analysis of the domains in this campaign “shows that the initial domains are being accessed worldwide,” although there is no indication of a large-scale campaign. The threat actor made an effort to make the malware look like a legitimate antivirus by created an appropriate graphical user interface.Ĭhoosing this disguise indicates that the actor is trying to trick users concerned about Pegasus spyware infecting their devices. The lure used in past campaigns is not clear at the moment but researchers at Cisco Talos spotted a new attack recently where Sarwent was delivered through a fake Amnesty International website advertising Anti-Pegasus AV. Sarwent-based attacks have been running since at least the beginning of the year, in January, and targeted a variety of victim profiles in several countries. The malware looks and acts the part of a legitimate antivirus solution specially created to scan the system for traces of Pegasus traces and to remove them. Threat actors are trying to capitalize on the recent revelations on Pegasus spyware from Amnesty International to drop a less-known remote access tool called Sarwent.

The amnesty international website