Italy – New Vidar Campaign Active via PEC: Leveraging C2 on Steam and Telegram Profiles

As of September 26, 2024, a cybercrime syndicate associated with the Vidar malware has escalated its activities, particularly targeting Italy by utilizing the Certified Electronic Mail (PEC) system. This strategy is proving to be highly effective in spreading malware, with a significant uptick in attacks seen across the region. Vidar, a form of malware known for its information-stealing capabilities, is now exploiting new channels for command and control (C2) servers, including Steam community profiles and Telegram.

This is the third Vidar campaign observed and mitigated by CERT-AGID (Computer Emergency Response Team – Agency for Digital Italy), with the direct support of PEC providers. The campaign’s methods have become somewhat familiar to cybersecurity professionals, with CERT-AGID and PEC managers developing specific measures to counteract these recurring attacks. However, the integration of platforms like Steam and Telegram represents a new and sophisticated development in how Vidar malware operates.

Email Campaign Utilizing PEC

The attack mechanism employed in this particular Vidar campaign revolves around the use of Italy’s PEC system. PEC is a secure and certified email system used by businesses, professionals, and government entities to exchange legally binding documents. Given the security protocols associated with PEC, its misuse for malicious activities is particularly concerning, as recipients are more likely to trust these emails.

The attackers have honed their strategy, sending well-crafted phishing emails that appear legitimate, often containing subjects related to unpaid invoices or other financial matters to induce a sense of urgency in the recipient. Once the recipient interacts with the email—typically by clicking a link or downloading a file—the malware is unleashed, compromising the user’s system.

The role of PEC in the propagation of this malware underlines a dangerous trend: cybercriminals are now exploiting even the most trusted communication channels. The trust inherent in these systems, especially PEC, makes them an ideal vector for delivering malware, as users tend to view these communications as safe.

Image source :https://cert-agid.gov.it/

The Threat of Vidar Malware: How the Exploitation of Steam and Telegram C2 Channels Can Damage Italian Companies and the Certified PEC Mail System

The use of Steam and Telegram by Vidar as command and control (C2) channels for malware can have severe repercussions for Italian companies, particularly those that rely on the Posta Elettronica Certificata (PEC) system, Italy’s certified email system with legal validity. The PEC system plays a critical role in Italy’s institutional and legal communications, and any compromise of this infrastructure by sophisticated malware like Vidar can lead to significant disruptions, financial losses, and institutional chaos. In this section, we will explore in detail how such a malicious campaign could target and damage Italian companies and their PEC systems, and the broader ramifications for institutional stability.

What is PEC Mail?

Posta Elettronica Certificata (PEC) is a certified email system widely used in Italy for formal and legal communication. Unlike traditional email, PEC emails have legal validity, equivalent to registered mail with a return receipt. PEC ensures that emails sent through this system can be verified as to their origin, content, and delivery, with timestamps provided by a trusted third party.

PEC is used for various critical purposes:

• Corporate Communication: Companies use PEC for official communications, legal documentation, and business correspondence that require formal acknowledgment or proof of delivery. This includes contracts, invoices, and employment documents.
• Government and Public Institutions: Italian public administrations rely heavily on PEC to communicate securely with citizens and businesses, sending tax notifications, fines, legal notices, and other binding communications.
• Legal and Judicial Use: PEC is also used in legal proceedings to send court documents, legal submissions, and official notifications between lawyers, courts, and other parties involved in legal cases.
• Financial Transactions and Documentation: Financial institutions use PEC to send formal documents related to banking, insurance, and other financial services.

In short, PEC mail has become integral to both business operations and public administration in Italy due to its unique status as a legally binding communication tool.

How Vidar Could Exploit PEC Mail

The inherent trust placed in the PEC system makes it an attractive target for cybercriminals. Vidar’s exploitation of Steam and Telegram as C2 channels makes it highly adaptable and difficult to detect, which increases the risk of it infiltrating critical systems, including those related to PEC.

• Credential Theft and Phishing Attacks: Vidar, being an information stealer, is particularly dangerous for systems like PEC that rely on trusted credentials. Once installed on a target system, Vidar can capture login credentials, security tokens, and personal information. For PEC users, this could mean unauthorized access to legally binding email accounts. Once an attacker gains access to a PEC account, they could impersonate legitimate users, sending fraudulent legal or financial requests that appear authentic. This could lead to severe financial fraud and legal confusion.
• Infection and Spread Through Corporate Networks: Vidar could potentially infiltrate corporate networks by compromising user devices. Through its C2 infrastructure, Vidar can communicate covertly, collecting sensitive information over time without detection. Once inside a company’s network, the malware could target PEC accounts, extracting confidential corporate communications, financial data, or intellectual property. Given the legally binding nature of PEC emails, the theft or manipulation of such information could have devastating consequences, leading to fraud, intellectual property theft, and loss of competitive advantage.
• Supply Chain Attacks: Italian companies that rely on PEC for communication with suppliers, customers, or government bodies are vulnerable to supply chain attacks facilitated by malware like Vidar. If a PEC account within a supply chain is compromised, attackers could inject malicious instructions or requests that appear legitimate. For instance, they could modify payment instructions, redirect shipments, or alter contracts, leading to financial losses and legal disputes.
• Ransomware Threat: Though Vidar itself is primarily an information stealer, malware campaigns often combine different attack techniques. Once attackers have gathered sufficient intelligence on a company’s PEC communications, they could escalate the attack by introducing ransomware or other disruptive malware into the corporate network. This would paralyze communications and operations that rely on PEC, forcing companies to halt business until the issue is resolved.
• Data Manipulation: Given the legal status of PEC emails, any unauthorized modification to the content of PEC communications could cause significant institutional damage. Attackers could intercept and alter emails between companies and government agencies or legal entities. This manipulation could lead to fraudulent agreements being signed, critical deadlines being missed, or legal disputes being influenced by falsified information. Such manipulation would not only have immediate consequences for the businesses involved but could also create widespread legal chaos.

The Broader Impact on the Italian Institutional Framework

Beyond individual companies, the exploitation of PEC mail by malware like Vidar could have a ripple effect across Italy’s broader institutional framework. The legal standing of PEC means that any compromise of the system could undermine the integrity of formal communications between businesses, public institutions, and citizens. The use of PEC in Italy is mandatory for all companies, professionals, and certain public institutions, making its security critical to the functioning of the country’s digital and legal infrastructure.

• Legal Uncertainty and Chaos: PEC communications are recognized as legally binding, and their integrity is paramount to the Italian legal system. A large-scale compromise of PEC accounts through a malware campaign could cast doubt on the authenticity of legal agreements, contracts, and court submissions. This could result in prolonged legal disputes, delays in court proceedings, and widespread uncertainty in the business and legal communities. If critical legal documents are tampered with or altered by attackers, the judicial system could face significant challenges in verifying their authenticity.
• Government Communications: Italian public institutions rely heavily on PEC to communicate with citizens and businesses. A compromise in this system could undermine trust in government communications. For instance, if malware allows unauthorized access to PEC accounts, attackers could impersonate government officials, sending fraudulent tax demands or fines. This would not only cause financial damage but could also erode trust in public institutions, creating confusion and chaos among citizens.
• Regulatory and Compliance Risks: Companies in Italy are required to comply with strict regulatory standards, particularly when it comes to data protection (under GDPR) and financial reporting. A successful Vidar campaign that targets PEC could expose sensitive financial data or lead to compliance violations. This could result in hefty fines, reputational damage, and loss of business for Italian companies, particularly those operating in regulated industries like finance and healthcare.
• Economic Impact: A widespread attack on PEC mail could disrupt business operations across various sectors of the economy. From small businesses to large corporations, the reliance on PEC for official and legal communications means that any disruption could halt business transactions, delay contracts, and cause financial turmoil. Italian companies that rely on timely, secure communications with suppliers, customers, or government agencies could face prolonged downtimes, leading to lost revenue and strained business relationships.
• Potential for Institutional Blackmail: In an advanced attack scenario, cybercriminals could use stolen or tampered PEC communications to blackmail companies or public institutions. If sensitive legal or financial information is stolen or altered, attackers could threaten to release or manipulate the data unless a ransom is paid. This type of institutional blackmail could create widespread chaos, as companies and government bodies scramble to protect their reputations and avoid costly legal disputes.

Steps to Mitigate the Risk

Given the potential damage that malware like Vidar can cause to Italian companies and the PEC system, it is critical that businesses and institutions take proactive steps to protect themselves. The following measures are crucial in mitigating the risks:

• Strengthening PEC Security: Companies and public institutions must implement strong authentication methods for PEC accounts, such as two-factor authentication (2FA) or hardware security tokens. This would make it more difficult for attackers to gain unauthorized access to PEC accounts, even if they manage to steal user credentials.
• Monitoring for Anomalies: Businesses should implement robust monitoring systems to detect suspicious activity within their networks. This includes monitoring PEC communications for signs of unusual behavior, such as unexpected login locations or abnormal patterns of email traffic. Early detection of a compromise could prevent more severe damage from occurring.
• Employee Training: Many malware campaigns, including those involving Vidar, begin with phishing attacks or social engineering. By training employees to recognize phishing attempts and the risks of malware, businesses can reduce the likelihood of initial infection. Employees must be aware of the importance of PEC security and the potential consequences of a compromise.
• Collaboration with Government and Cybersecurity Agencies: Given the critical nature of the PEC system, there must be close collaboration between businesses, government bodies, and cybersecurity agencies to develop comprehensive strategies for protecting PEC infrastructure. This may include regular security audits, sharing threat intelligence, and creating emergency response plans in the event of a compromise.
• Regular Updates and Patching: Companies should ensure that their software, especially PEC-related applications and platforms, is regularly updated and patched. This minimizes the risk of exploitation through vulnerabilities that malware like Vidar can use to infiltrate systems.

A Call for Vigilance

Vidar’s use of Steam and Telegram as C2 channels represents a sophisticated threat that extends beyond individual targets. In the context of Italy, where the PEC mail system plays a pivotal role in business, legal, and governmental communications, a compromise of this system could have far-reaching consequences. The damage would not be limited to financial losses but could also result in institutional chaos, legal uncertainty, and widespread disruption across the public and private sectors.

As cybercriminals continue to evolve their tactics, Italian companies and institutions must remain vigilant and adopt a proactive approach to cybersecurity. By strengthening the security of PEC systems, raising awareness of the threats posed by malware, and collaborating closely with cybersecurity experts, Italy can protect its vital communications infrastructure and avoid the potential chaos that would result from a large-scale compromise of PEC mail.

The Evolution of Vidar’s Command and Control Channels: Steam and Telegram

In the evolving landscape of cybersecurity threats, the adaptability and innovation of malware developers remain constant concerns. Vidar, a well-known infostealer malware, exemplifies this adaptability through its evolving use of popular platforms to communicate with its Command and Control (C2) infrastructure. Historically associated with Steam, Vidar has recently introduced the use of Telegram, offering a new layer of complexity to its operations. This dual-channel strategy — leveraging both Steam and Telegram — adds an intricate layer of obscurity, making detection and mitigation efforts increasingly difficult for cybersecurity professionals. This article delves deeply into this evolution, examining the techniques, implications, and challenges posed by these novel C2 mechanisms.

Steam Community as a Command and Control Channel

Steam, a platform initially developed for gaming and social interaction among gamers, is now being exploited by cybercriminals for malicious purposes. The platform, which boasts over 120 million monthly active users, has traditionally been seen as a secure environment, with its ecosystem encompassing legitimate gaming-related activities, discussions, and content sharing. However, the legitimacy and trust associated with Steam have made it an attractive target for malicious actors seeking to blend into the background of an unsuspecting and widely trusted network.

Vidar’s use of Steam as a C2 channel is neither new nor unexpected; previous campaigns have already demonstrated the efficacy of this method. However, the tactic has evolved significantly, becoming more sophisticated and harder to detect. The attackers behind Vidar have exploited Steam’s community profiles by embedding IP addresses of their C2 servers in the profiles’ bios, often hidden among legitimate gaming content. This allows attackers to “hide in plain sight,” leveraging the social nature of the platform and its robust user base to their advantage.

The Steam community profiles serve as conduits for the dissemination of critical operational information. By embedding IP addresses within these profiles, attackers are able to communicate covertly with infected systems. Malware hosted on an infected machine is programmed to retrieve specific IP addresses from the bios of Steam profiles, effectively using Steam as a relay point. This form of C2 communication is advantageous because it uses a trusted platform that is unlikely to raise red flags during routine network monitoring. Furthermore, the flexibility of the Steam community profiles allows for rapid changes, meaning attackers can update their C2 addresses without requiring significant modifications to the malware itself.

Steam’s use for C2 channels by Vidar also raises questions about platform responsibility and security. While Steam has a robust moderation system in place, the sheer volume of users and content makes it incredibly difficult to scrutinize every interaction, especially given that attackers have become adept at hiding malicious data among legitimate content. Steam’s community features, particularly its profile bios and discussion forums, provide easy-to-overlook avenues for embedding malicious information. Thus, from a technical perspective, the attackers exploit both the platform’s widespread trust and its large, unsupervised environment for distributing their malware.

In many ways, Steam’s community-driven features are its greatest asset — and its greatest vulnerability. The use of gaming platforms for illicit purposes is not new, but Vidar’s specific exploitation of Steam represents an evolution in the methods cybercriminals use to avoid detection. Traditional security tools and monitoring systems are not typically designed to scrutinize legitimate platforms such as Steam for malicious behavior. This provides the attackers with a built-in defense against detection.

Vidar’s Transition to Telegram: A New Frontier for Command and Control

In addition to leveraging Steam, Vidar’s operators have begun incorporating Telegram as a C2 communication platform. The decision to adopt Telegram is a notable development, as the platform offers a degree of encryption, anonymity, and scalability that is attractive to cybercriminals. Telegram, which boasts over 700 million monthly active users, is one of the world’s most widely used messaging platforms, prized for its security features and user-friendly design. However, it is precisely these features that make it attractive to malicious actors seeking a low-profile method of communication.

Vidar’s use of Telegram mirrors its Steam-based tactics. In this campaign, the attackers use Telegram profiles to publish C2 server IP addresses, much like they do with Steam bios. These IP addresses are then retrieved by the malware running on infected systems. Telegram’s encryption and security features make it difficult for cybersecurity professionals to monitor and intercept these communications, further complicating the detection and mitigation process.

Telegram’s rise as a C2 channel reflects a growing trend in the use of mainstream, encrypted communication platforms by cybercriminals. In this campaign, Vidar’s operators have used Telegram profiles, likely assuming that the platform’s encrypted nature would provide an additional layer of security. In essence, the attackers are betting on the difficulty that security analysts face when monitoring encrypted communications — and for now, it appears to be working. Telegram’s role as a secure messaging app has given it widespread adoption in many regions, making it difficult for cybersecurity professionals to isolate and block malicious accounts without infringing upon legitimate use cases.

Moreover, Telegram’s flexibility as a communication tool offers attackers various ways to remain anonymous. Attackers can easily create multiple accounts with limited verification, spread out their malicious activity across a number of channels, and take advantage of the app’s encrypted messaging and profile features. This allows them to maintain a presence on the platform without drawing undue attention from moderators or cybersecurity experts.

Another aspect of Telegram that is particularly attractive to cybercriminals is the ease with which C2 communication can be updated or changed. Just as with Steam profiles, Telegram allows the operators of Vidar to update their C2 addresses in real-time, ensuring that the malware remains operational even if one server is taken down. By leveraging the app’s user-friendly interface and vast community, attackers are able to continue their campaigns without disruption, updating and disseminating critical C2 information with little to no oversight.

The Implications of Vidar’s Dual-Channel Approach

The dual-use of Steam and Telegram as C2 channels marks a significant evolution in the way Vidar operates, and it poses a substantial challenge to cybersecurity professionals. Traditional detection mechanisms are not equipped to handle the use of widely trusted platforms such as Steam and Telegram as vectors for malware communication. This complicates efforts to track, monitor, and dismantle the infrastructure supporting these campaigns.

From a technical standpoint, this approach highlights the growing sophistication of malware developers. The use of Steam and Telegram demonstrates a keen understanding of both the strengths and weaknesses of modern cybersecurity infrastructure. These platforms, which are trusted and heavily used, offer cybercriminals an excellent opportunity to mask their activities among legitimate traffic. The complexity of detecting malware communications embedded within legitimate platforms such as Steam or Telegram is compounded by the fact that traditional monitoring systems are not designed to analyze these forms of communication.

In particular, the use of encrypted messaging platforms like Telegram introduces a new layer of complexity. Encrypted communications are notoriously difficult to monitor, and while Telegram does have some mechanisms in place to detect and remove malicious activity, the sheer volume of users makes it almost impossible to police every interaction. The adoption of Telegram as a C2 channel highlights a shift in the tactics used by cybercriminals, moving away from more easily detectable communication methods to ones that are inherently harder to monitor.

Moreover, the dual-channel approach used by Vidar demonstrates the growing trend of cybercriminals employing multiple C2 channels in a single campaign. This increases the resilience of their operations, as the use of multiple communication platforms makes it harder for security professionals to fully dismantle the C2 infrastructure. Even if one platform is compromised, the malware can continue to function using the other, ensuring that the attackers maintain operational capability.

The Challenges for Cybersecurity Professionals

Vidar’s use of both Steam and Telegram as C2 channels presents a number of challenges for cybersecurity professionals. First and foremost, the use of legitimate platforms makes it difficult to detect malicious activity. Security tools that monitor for unusual network traffic or suspicious domain activity are not typically designed to scrutinize legitimate platforms such as Steam or Telegram for C2 communications. This means that attackers can leverage these platforms to communicate with infected systems without raising immediate red flags.

Additionally, the use of encrypted platforms like Telegram complicates the ability of cybersecurity professionals to monitor and intercept C2 communications. Encrypted communications are designed to be secure and private, making it difficult for security teams to access the contents of messages or profiles without violating privacy rights. This leaves security professionals in a precarious position, as they must balance the need for privacy with the need to detect and mitigate malware activity.

Moreover, the flexibility of platforms like Steam and Telegram makes it easy for attackers to update and modify their C2 infrastructure in real-time. If a C2 server is taken down or blocked, attackers can simply update their Steam or Telegram profiles with new information, ensuring that their malware remains operational. This constant adaptability makes it difficult for security teams to fully dismantle a campaign, as attackers can quickly re-establish communication with their infected systems using new C2 servers.

To combat this growing threat, cybersecurity professionals will need to develop new strategies and tools designed to detect and mitigate malware activity on legitimate platforms. This may include developing machine learning algorithms capable of detecting suspicious behavior within trusted platforms, as well as working closely with platform providers to identify and remove malicious accounts. Additionally, there will be a growing need for collaboration between security teams and platform providers to ensure that malicious activity is detected and mitigated as quickly as possible.

Mitigation Efforts and Countermeasures

CERT-AGID, alongside PEC providers, has been actively working to combat this latest Vidar campaign. Several key countermeasures have been implemented to mitigate the spread of malware and protect users from falling victim to these attacks.

The Indicators of Compromise (IoCs) related to this campaign have been distributed via CERT-AGID’s IoC feed to PEC providers and other accredited structures. These IoCs include IP addresses, domain names, URLs, and file hashes associated with the malicious campaign, enabling organizations to update their security systems and prevent further infections.

Moreover, PEC providers have tightened their monitoring systems to detect and block suspicious activity in real-time. In some cases, this involves scanning for specific characteristics in emails, such as unusual attachments or links to known malicious domains, and flagging or blocking these communications before they reach the intended recipient.

The Role of Awareness and User Vigilance

While the technical countermeasures implemented by CERT-AGID and PEC providers are vital, user awareness and vigilance remain critical components of any defense strategy. Users must be educated to recognize the signs of a potential phishing attack, even if the email appears to come from a trusted source like PEC.

To assist with this, CERT-AGID recommends that users exercise caution when receiving emails that contain unexpected attachments or links, especially those related to financial matters such as unpaid invoices. If there is any doubt about the legitimacy of an email, users should forward the suspicious email to CERT-AGID for analysis ([email protected]).

Detailed IoCs of the Campaign

In an effort to provide full transparency and enable other organizations to protect themselves, CERT-AGID has released detailed IoCs for the Vidar campaign. These include:

• MD5 Hash: 8b0b12811b60a92a72b636a46fadb0ba
• SHA-1 Hash: 0ab6b31b69b7964de2e9639169d036c68f9efd76
• SHA-256 Hash: 1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c
• Domains:
  • ewiojfohvuysu.top
  • opzovbjzueg.top
  • bha736beb9vnaj46ubv09j1l382oejyefmosr9rthohnt.skyblueten.com
  • skyblueten.com
  • jhfdkihdcinfhdn.top
• URLs:
  • http://jhfdkihdcinfhdn.top/t8y1zm36kbhtr.php?id=DESKTOP-ET51AJO&key=63541632480&s=mints13
  • http://opzovbjzueg.top/1.php?s=mints13
  • https://5.75.211.162/sqlp.dll
  • http://ewiojfohvuysu.top/1.php?s=mints13
  • https://116.203.15.34
• IP Addresses:
  • 116.203.15.34
  • 116.203.165.127
  • 5.75.211.162
  • 116.202.1.77
  • 147.45.44.104

The meticulous detailing of these IoCs helps security teams around the world to update their defense mechanisms, ensuring that systems remain protected against this evolving threat.

It is interesting to note that one of the IP addresses contacted by Vidar is already known to have been used by other malware, as highlighted in this tweet yesterday.

Samples related to IP 147.45.44[.131

💮https://t.co/UFnvbjTGkA💮#LummaStealer#RemcosRAT#RustyStealer#NetSupportRAT#Arechclient#QuasarRAT#DCRat#RedLineStealer pic.twitter.com/Zabf5bota7

— JAMESWT (@JAMESWT_MHT) September 25, 2024

The Broader Implications of Vidar’s Continued Evolution

The emergence of Vidar’s latest campaign illustrates the rapidly changing landscape of cybercrime. Attackers are becoming increasingly innovative, leveraging trusted communication channels like PEC, as well as popular platforms such as Steam and Telegram, to further their malicious agendas. By exploiting these trusted platforms, attackers make it more difficult for users and cybersecurity professionals to detect their activities.

The use of platforms such as Steam and Telegram for C2 communication is a prime example of how cybercriminals continuously adapt their tactics to evade detection. This shift highlights the need for more sophisticated detection techniques and underscores the importance of collaboration between cybersecurity entities and platform providers.

Organizations need to recognize that no system is entirely safe from exploitation. Even highly regulated and trusted systems like PEC are vulnerable to misuse if attackers can find ways to circumvent security protocols. This reality underscores the importance of continuous improvement in cybersecurity measures, from awareness campaigns to the adoption of advanced threat detection systems.

In conclusion, the latest Vidar campaign targeting Italian PEC users serves as a stark reminder of the evolving nature of cyber threats. By expanding their operations to include platforms like Steam and Telegram, cybercriminals demonstrate their ability to innovate and adapt. It is incumbent upon both organizations and individuals to remain vigilant, stay informed, and adopt the latest cybersecurity practices to protect against this persistent and growing threat.

---

APPENDIX 1 – The Sophisticated Evolution of Vidar Malware: How the Exploitation of Steam and Telegram Threatens Italian Companies and the Integrity of the Certified PEC Mail System

The evolution of the Vidar malware campaign, particularly its recent use of platforms like Steam and Telegram as command and control (C2) channels, represents a novel and complex threat that has captured the attention of cybersecurity professionals, including Italy’s Computer Emergency Response Team for public administration (CERT-AGID) and PEC system managers. While some aspects of Vidar’s attack methods have become familiar, such as credential theft and information exfiltration, the integration of widely trusted platforms like Steam and Telegram has introduced new challenges. This section delves into the inner workings of these methods, providing real examples, detailed functionality, and analyzing the broader political and social consequences for Italy.

Familiar Methods and CERT-AGID’s Countermeasures

Cybersecurity professionals have grown accustomed to dealing with traditional Vidar malware campaigns. Historically, Vidar has been used to steal sensitive information, including login credentials, payment details, and browser cookies, from infected systems. These stolen assets are then sent back to the attacker’s command and control servers, where they can be used for financial fraud, identity theft, or sold on dark web marketplaces.

To counteract these threats, CERT-AGID has worked closely with PEC managers and cybersecurity firms to develop targeted countermeasures. These include:

• Endpoint Protection Solutions: To detect and stop malware like Vidar before it can cause harm, many organizations in Italy, particularly those managing PEC systems, have implemented endpoint protection solutions. These tools are designed to detect suspicious activity at the device level and block malicious files before they can exfiltrate sensitive data.
• Network Traffic Monitoring: PEC managers and cybersecurity teams use advanced monitoring tools to scrutinize network traffic for signs of abnormal activity, such as unusual communication with external servers or spikes in data exfiltration. This can help detect Vidar’s attempts to contact its C2 servers.
• Regular Patch Management: One of the most common ways Vidar gains access to systems is through exploiting software vulnerabilities. CERT-AGID and PEC managers enforce rigorous patching schedules to ensure that all systems are updated, reducing the risk of successful exploitation.

Despite these countermeasures, Vidar’s operators have evolved their tactics by integrating platforms like Steam and Telegram, which are not traditionally associated with malware activity. This shift complicates the detection process, as these platforms are typically viewed as benign by security systems.

Vidar’s Exploitation of Steam: Detailed Functionality and Attack Scheme

How Vidar Uses Steam for C2 Communication

Steam is a global gaming platform with millions of users, providing a rich environment for cybercriminals to blend in with legitimate activity. Vidar’s operators exploit the platform by using Steam community profiles to host C2 information, specifically by embedding IP addresses within profile bios or descriptions. These profiles are publicly accessible, and they allow malware to fetch updated C2 server addresses from the profile descriptions, which the attackers can modify at will.

Here’s a detailed breakdown of how Vidar’s Steam-based C2 system works:

• Profile Creation: Attackers create Steam profiles under legitimate-sounding usernames, often associated with gaming or innocuous activities. Within the “About Me” or “Biography” section, they embed the IP addresses or domain names of C2 servers.
• Infection: Once a system is infected with Vidar, the malware begins by extracting the necessary information from the infected machine, such as credentials and stored passwords. It then contacts Steam to retrieve the specific profile ID hardcoded into the malware.
• C2 Communication: The malware parses the profile bio to extract the IP address or domain name of the C2 server. By using a legitimate platform like Steam, Vidar’s operators avoid using suspicious, easily-blockable domain names, thereby evading traditional network filters.
• Dynamic Updates: One of the key advantages of using Steam is the ability for attackers to update the C2 information at any time. This allows them to change IP addresses or domain names in real-time, without needing to update the malware itself, which makes takedowns significantly harder for cybersecurity professionals.
• Data Exfiltration: Once the malware has established communication with its C2 server via the Steam profile, it begins transmitting the stolen data. This data can include anything from browser histories to cryptocurrency wallet keys, depending on the goals of the attackers.

Real-World Example of Steam-Based C2

A recent campaign using this technique involved attackers embedding C2 server information in Steam profiles associated with gaming communities. In one documented case, an attacker used the profile name “GameFan1994” and embedded an IP address within the biography, cleverly obscured by referencing game tactics. Infected machines communicated with this Steam profile, retrieving the necessary C2 information to continue data exfiltration.

Vidar’s Use of Telegram: Detailed Functionality and Attack Scheme

How Vidar Uses Telegram for C2 Communication

Telegram, a widely used encrypted messaging platform, offers attackers several advantages for C2 communications. Its end-to-end encryption, anonymity features, and ease of account creation make it an attractive tool for Vidar’s operators. The specific methodology used by Vidar when exploiting Telegram is as follows:

• Creation of Telegram Accounts: Attackers create multiple Telegram accounts, each of which may contain critical C2 information, including IP addresses or domain names, stored within the profile description or linked to private channels.
• Encrypted C2 Updates: Once an infected system is in operation, the Vidar malware contacts specific Telegram profiles to retrieve C2 addresses. These communications are encrypted, making it difficult for traditional network monitoring tools to intercept or analyze them.
• Dynamic Flexibility: Like Steam, Telegram’s flexible nature allows attackers to change C2 server information quickly. They can modify profile bios or channel links to redirect Vidar malware to new servers without having to alter the malware’s underlying code.
• Anonymity: Telegram’s architecture enables attackers to operate with a high degree of anonymity, making it difficult for law enforcement or security researchers to trace their real identities or locations. Telegram’s minimal requirements for account creation further compound this issue, allowing operators to create and discard accounts as needed.

Real-World Example of Telegram-Based C2

In a recent Vidar campaign, attackers created a Telegram channel named “SecureComm1994” that appeared legitimate, promoting secure communication tools. However, buried within the channel’s descriptions and posts were C2 server addresses disguised as links to secure messaging protocols. Infected machines would query this Telegram channel, extract the relevant C2 information, and transmit stolen data back to the attackers.

Finality of the Campaign: Financial and Political Consequences

Vidar’s integration of Steam and Telegram into its C2 infrastructure significantly broadens the malware’s reach and resilience. The finality of this campaign is multifaceted, aiming to achieve several key goals:

• Financial Theft and Fraud: Vidar’s primary purpose is financial theft. By stealing credentials, credit card information, and cryptocurrency wallet keys, the malware enables attackers to drain accounts and engage in fraudulent financial transactions. The use of trusted platforms like Steam and Telegram increases the difficulty for victims and cybersecurity professionals to detect and stop these thefts before significant damage is done.
• Espionage and Intellectual Property Theft: Italian companies, particularly those involved in industries like manufacturing, energy, and finance, are at risk of industrial espionage. Vidar’s ability to steal sensitive corporate data could lead to significant intellectual property theft, placing Italian firms at a competitive disadvantage in global markets.
• Institutional Chaos: The campaign’s integration of PEC system targets poses a direct threat to Italy’s institutional stability. By compromising the PEC system, attackers could engage in fraud, such as sending falsified legal documents or tax notices. This would create widespread confusion, legal disputes, and undermine the trust in Italy’s digital communications infrastructure. Imagine a scenario where fake court summonses or government fines are sent out, leading to institutional paralysis as companies and individuals attempt to verify the authenticity of these documents.

Political and Social Consequences

The broader political and social consequences of Vidar’s evolution cannot be underestimated. The combination of malware targeting both corporate and institutional communications could lead to several destabilizing effects:

• Loss of Public Trust in Digital Infrastructure: The use of PEC in Italy is critical for public administration, legal communication, and business operations. If Vidar’s operators successfully compromise a significant number of PEC accounts, public trust in this system could erode, leading to a shift away from digital communication and a regression to more traditional methods, which are less efficient and slower.
• National Security Risks: Vidar’s ability to target PEC accounts could be exploited by state-sponsored actors or politically motivated groups. A large-scale attack on the PEC system could paralyze government operations, especially in sensitive areas such as taxation, law enforcement, and public administration. In the worst-case scenario, such an attack could be used to manipulate or disrupt election processes or critical government functions.
• Economic Impact: As Vidar continues to target Italian companies, the financial consequences could be severe. Businesses may face direct financial losses from fraud, but they could also suffer from secondary effects, such as reputational damage and loss of business due to the compromise of sensitive data. This could lead to job losses, reduced foreign investment, and long-term economic stagnation in sectors heavily reliant on digital infrastructure.
• Political Fallout: In the wake of a large-scale attack on Italy’s PEC system or its business community, there could be significant political fallout. Government officials would be under intense scrutiny to explain how such an attack was allowed to happen, and there may be calls for new regulations or changes in leadership. Moreover, political opposition parties could use the chaos to challenge the government’s competence in managing cybersecurity and digital infrastructure.

The evolution of Vidar malware, especially through its integration of Steam and Telegram as C2 channels, represents a sophisticated and dangerous development in the realm of cyber threats. For Italy, the potential damage extends beyond individual companies to the very fabric of its institutional, economic, and political landscape. As Vidar’s operators continue to refine their tactics, it is critical that Italian companies, PEC managers, and cybersecurity professionals remain vigilant, adopting advanced countermeasures and collaborating closely with government agencies like CERT-AGID to mitigate the threat posed by this increasingly sophisticated malware. The stakes could not be higher, as the consequences of inaction could lead to widespread institutional chaos, financial losses, and a significant erosion of public trust in Italy’s digital infrastructure.

---

APPENDIX 2 – Vidar Malware Attacks Worldwide: Impact and Damages – A Focus on Italy, Europe, and Global Scale

The Vidar malware, a notorious info-stealer, has been widely distributed across several regions, targeting businesses, government institutions, and individuals globally. Its most concerning characteristic is its ability to evolve and exploit both traditional and novel attack vectors, making it a persistent threat in the cybersecurity landscape.

Italy

Italy has been a significant target of Vidar campaigns, with a particular focus on exploiting the PEC (Posta Elettronica Certificata) system, which is the country’s certified email system with legal validity. In 2023 and 2024, several waves of attacks were launched against Italian companies through PEC emails. These campaigns often involve phishing emails posing as legitimate PEC communications—usually disguised as overdue payment requests or legal threats. The attackers embed links to malicious downloads, which, when clicked, initiate the installation of Vidar malware. This results in credential theft, exfiltration of sensitive legal documents, and access to corporate networks.

The impact on PEC has been substantial, as it is a critical part of Italy’s legal communication infrastructure. These compromises lead to institutional disruption, legal confusion, and widespread phishing attempts, affecting both businesses and public trust in the digital communication systems. To counter these, CERT-AGID and PEC managers have implemented various security protocols, blocking over 12,000 malicious email addresses associated with Vidar campaigns in Italy.

Europe

Across Europe, Vidar has continued to be a persistent threat, particularly targeting Windows-based systems through malicious spam emails, phishing campaigns, and fake software cracks. The malware’s operators have also exploited underground forums to offer Vidar as Malware-as-a-Service (MaaS), making it accessible to a broad range of cybercriminals. Key damages in Europe include:

• Financial theft: Vidar has been used to steal banking credentials, cryptocurrency wallet information, and sensitive financial data from individuals and businesses alike.
• Corporate espionage: European companies, particularly in sectors like finance and technology, have faced intellectual property theft and other forms of corporate data breaches.
• Government systems: Although less frequent, government agencies across Europe have also been targeted, leading to concerns about sensitive data being exposed to malicious actors.

Cybersecurity experts have noted that Vidar’s use of platforms like Steam and Telegram for command and control (C2) operations complicates detection efforts. These platforms are trusted, making it harder to identify malicious activity without raising false alarms. In regions like Germany and France, significant efforts have been made to block known C2 servers and improve network traffic monitoring.

Global Scale

Globally, Vidar continues to cause significant damage, especially in North America and parts of Asia. Vidar’s flexible architecture allows it to be modified quickly to evade traditional security systems, and the adoption of sophisticated keylogging and screen capturing functionalities has increased the breadth of data stolen by the malware. In addition to financial and corporate damages, some attacks have escalated into ransomware campaigns, with Vidar acting as a precursor to more devastating malware strains.

Key global trends include:

• Widespread phishing: Vidar is frequently delivered through phishing attacks, with millions of spam emails distributed globally, targeting both individuals and enterprises.
• Ransomware connections: Vidar is often used as a downloader, initiating ransomware attacks after gathering sufficient intelligence from infected systems.
• Marketplace proliferation: The sale of Vidar on underground markets has made it accessible to less technically advanced cybercriminals, broadening its reach.

In conclusion, Vidar continues to evolve as a global cyber threat, particularly in regions like Italy where critical infrastructure like PEC is targeted. Its ability to exploit trusted platforms such as Steam and Telegram adds a layer of complexity for cybersecurity defenses, making global vigilance and coordinated responses essential in mitigating its widespread impact.

Region	Year	Method of Attack	Target	Damages	Countermeasures
Italy	2023-2024	Malicious PEC emails posing as overdue invoices and legal threats.	Italian businesses and PEC users	Stolen credentials, legal document exfiltration, damage to PEC’s trustworthiness and financial loss.	CERT-AGID blocked over 12,000 malicious PEC addresses. Alerts sent to PEC managers, and companies trained to identify phishing links​.
Germany	2023-2024	Spam emails and phishing campaigns using Vidar as MaaS via Steam and Telegram.	Financial institutions, businesses	Banking credential theft, cryptocurrency wallet hacks, corporate espionage.	Network monitoring, C2 server blocking, and collaboration with Telegram and Steam to identify malicious users​.
France	2023-2024	Downloaders in fake software cracks and malicious attachments in phishing emails.	SMEs and individual users	Personal and business data theft, financial fraud, compromised customer accounts.	Companies have increased endpoint monitoring and adopted advanced phishing filters for corporate emails​.
Global (USA, Asia)	2022-2024	Mass phishing campaigns via email and social media platforms (Telegram and Steam).	Individuals, corporations, and banks	Identity theft, financial loss, initiation of ransomware through Vidar downloads.	Advanced threat intelligence shared globally, more robust email filtering, and end-user training to detect phishing​.
Spain	2023	Phishing emails posing as software updates or legal notifications from local authorities.	Government institutions	Data breaches, unauthorized access to sensitive legal documents, and loss of public trust.	Deployment of stronger email filters in government systems, enhanced employee cybersecurity awareness​.
Global	2021-2024	Use of Telegram for encrypted C2 communications, making detection difficult.	Windows-based systems globally	Keylogging, screen captures, identity theft, fraud via stolen credentials, and intellectual property theft.	Increasing cooperation between cybersecurity experts and platforms like Telegram to block malicious actors; use of real-time C2 server monitoring and domain takedowns​.

---

Copyright of debuglies.com
Even partial reproduction of the contents is not permitted without prior authorization – Reproduction reserved