Ethical Hacking News
ComicForm Group Deploys Formbook Malware in Eurasian Cyberattacks Targeting Belarus, Kazakhstan, and Russia.
ComicForm, a previously undocumented hacking group, deployed Formbook malware in a cyberattack targeting Belarus, Kazakhstan, and Russia. The attack began at least April 2025 and was primarily directed towards industrial, financial, tourism, biotechnology, research, and trade sectors. Phishing emails were sent with obfuscated .NET loaders that launched malicious DLLs and subsequently ran Formbook malware. ComicForm's infrastructure revealed signs of phishing attacks against companies in Kazakhstan and Belarus. The attackers used English-language emails to target organizations in other countries, including South Korea.
Recently, a cyberattack was uncovered by cybersecurity company F6 that involved the deployment of Formbook malware by a previously undocumented hacking group called ComicForm. The attack targeted industrial, financial, tourism, biotechnology, research, and trade sectors in Belarus, Kazakhstan, and Russia.
According to the analysis published last week by F6, the activity began at least April 2025 and was primarily directed towards these sectors. The attack chain involved sending emails bearing subject lines like "Waiting for the signed document," "INvoice for Payment," or "Reconciliation Act for Signature." These messages urged recipients to open an RR archive, within which there existed a Windows executable that masqueraded as a PDF document (e.g., "Акт_сверки pdf 010.exe").
These messages were sent from email addresses registered in the .ru, .by, and .kz top-level domains. The executable was an obfuscated .NET loader designed to launch a malicious DLL ("MechMatrix Pro.dll"), which subsequently ran a third-stage payload, another DLL named "Montero.dll" that served as a dropper for the Formbook malware.
Interestingly, the binary also contained Tumblr links pointing to completely harmless GIFs of comic superheroes like Batman. "These images were not used in any attack," F6 researcher Vladislav Kugan said, "but were merely part of the malware code."
Analysis of ComicForm's infrastructure has revealed signs that phishing emails have also been directed against an unspecified company operating in Kazakhstan in June 2025 and a Belarusian bank in April 2025. Furthermore, it was detected that phishing emails sent to Russian manufacturing companies from the email address of a Kazakhstan-based industrial company as recently as July 25, 2025.
These digital missives prompted prospective targets to click on an embedded link to confirm their account and avoid a potential block. Users who clicked on the link were redirected to a bogus landing page mimicking the login page of a domestic document management service to facilitate credential theft by transmitting the entered information to an attacker-controlled domain in the form of an HTTP POST request.
The attack aimed at the Belarusian bank involved sending a phishing email with an invoice-themed lure to trick users into entering their email addresses and phone numbers in a form, which were then captured and sent to an external domain. The group attacks Russian, Belarusian, and Kazakh companies from various sectors, and the use of English-language emails suggests that the attackers are also targeting organizations in other countries.
"The attackers employ both phishing emails distributing FormBook malware and phishing resources disguised as web services to harvest access credentials," F6 said.
The disclosure comes as the NSHC ThreatRecon Team disclosed details of a pro-Russian cybercrime group that has targeted manufacturing, energy, and semiconductor sectors in South Korea. The activity has been attributed to a cluster called SectorJ149 (aka UAC-0050).
The attacks commenced with spear-phishing emails targeting executives and employees using lures related to production facility purchases or quotation requests. These emails led to the execution of commodity malware families like Lumma Stealer, Formbook, and Remcos RAT by means of a Visual Basic Script distributed as a Microsoft cabinet (CAB) archive.
The Visual Basic Script is engineered to run a PowerShell command that reaches out to a Bitbucket or GitHub repository to fetch a JPG image file. This concealed a loader executable responsible for launching the final stealer and RAT payloads in memory area.
"The PE Malware executed directly in the memory area is a loader-type Malware," F6 said, "that downloads additional malicious data disguised as a text file (.txt) through a URL included in the provided parameter values, decrypts it, and then generates and executes the PE Malware."
"In the past, the SectorJ149 group primarily operated for financial gain," the Singaporean cybersecurity company said, "but the recent hacking activities targeting Korean companies are believed to have a strong hacktivist nature, using hacking techniques to convey political, social, or ideological messages."
Related Information:
https://www.ethicalhackingnews.com/articles/Cyberattacks-Emerge-from-Eurasian-Region-as-ComicForm-Group-Deploys-Formbook-Malware-ehn.shtml
https://thehackernews.com/2025/09/comicform-and-sectorj149-hackers-deploy.html
Published: Mon Sep 22 12:01:17 2025 by llama3.2 3B Q4_K_M
