iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a campaign Kaspersky detected in late July 2024, phishing emails carrying malicious Windows shortcut files led to a chain of backdoors and surveillance tools. The activity targeted dozens of computers at Russian government organizations and IT companies. Kaspersky’s report describes the sequence as a Dropbox-connected backdoor, GrewApacha, an updated CloudSorcerer, and a previously unknown implant it named PlugY—not one interchangeable piece of malware.
How the EastWind attack unfolded
Kaspersky’s GReAT team published its technical account on 14 August 2024. It reported observing attacks in late July against dozens of computers at Russian government organizations and IT companies; the report does not give an exact victim count. The reported delivery method was phishing email with a malicious shortcut attachment. Secondary coverage says the shortcut was inside a RAR archive, but the technical sequence below is based primarily on Kaspersky’s analysis.
- Phishing attachment: A recipient was sent a Windows shortcut (LNK) file. A shortcut can launch a program or invoke a command when opened, so a malicious one can start an execution chain rather than merely display a document.
- DLL side-loading: The shortcut led into a chain that abused DLL loading to run malicious code alongside a legitimate executable. In this technique, a program loads a malicious library from a location where it expects a DLL, allowing the library’s code to execute in the program’s context.
- Dropbox-connected backdoor: The first backdoor used Dropbox to obtain commands and exchange files. Kaspersky identifies its library as VERSION.dll and describes it as able to gather information, download files, and execute them.
- Further implants: The operation also involved GrewApacha and an updated CloudSorcerer. Kaspersky says CloudSorcerer downloaded a previously unknown implant that it named PlugY.
Kaspersky’s campaign report notes that the attackers used popular network services—including GitHub, Dropbox, Quora, LiveJournal, and Yandex.Disk—as command-and-control infrastructure. Cloud and social services can blend malicious traffic into otherwise ordinary network activity, so an allowed service connection is not by itself proof of infection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What each malware component did
| Component | Role in the reported campaign | Communication or execution details |
|---|---|---|
| Dropbox-connected backdoor (VERSION.dll) | Initial backdoor described in Kaspersky’s technical analysis; gathered information and handled additional files. | Read command material from a cloud-stored file associated with the infected computer and uploaded results to another file in that storage. Its commands were DIR, EXEC, SLEEP, UPLOAD, and DOWNLOAD. |
| GrewApacha | A remote access trojan (RAT) that Kaspersky describes as used by APT31 since 2021. | In the analyzed sample, it retrieved a GitHub profile bio, decoded a Base64 string, then XOR-decrypted it to obtain its main command-and-control address. |
| CloudSorcerer | An updated backdoor in the reported activity that downloaded PlugY. | Kaspersky describes CloudSorcerer as using online services for command and control. The report does not make CloudSorcerer interchangeable with the other implants. |
| PlugY | A previously unknown implant downloaded by the updated CloudSorcerer. | Could contact command and control over TCP, UDP, or named pipes. Its capabilities included file manipulation, shell execution, keystroke logging, and screen or clipboard monitoring. |
Dropbox backdoor commands
Kaspersky lists five commands for the Dropbox-connected VERSION.dll component. DIR is associated with directory listing, EXEC with execution, SLEEP with pausing, and UPLOAD and DOWNLOAD with file transfer. These names describe the command set in the analyzed malware; they should not be treated as a complete description of every EastWind sample.
How the analyzed GrewApacha sample found its server
Kaspersky says the analyzed GrewApacha sample was delivered through a side-loading triad: a legitimate Microsoft-signed executable, a malicious library, and an encrypted payload. The RAT fetched a GitHub profile bio, decoded a Base64 string, and then XOR-decrypted it to recover its main command-and-control address. This is a sample-specific mechanism in Kaspersky’s analysis, not an established feature of every GrewApacha variant.
What PlugY could do
PlugY’s network options included TCP, UDP, and named pipes. Kaspersky describes commands for file operations and shell activity, plus surveillance functions such as recording keystrokes and monitoring the screen or clipboard. Those capabilities make PlugY more than a downloader: the implant could support remote interaction and collection after it was installed.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
Does PlugY prove APT27 was behind EastWind?
No. Kaspersky reports code and architectural similarities between PlugY and DRBControl, also known as Clambling, and notes overlap with a communications library seen in DRBControl and PlugX samples. It concluded that code previously observed in APT27 attacks was likely used in PlugY’s development. That is evidence about tools or code relationships, not proof that APT27 operated EastWind or that APT27 and another group formally collaborated.
Kaspersky separately characterizes GrewApacha as a RAT used by APT31 since 2021. A tool’s historical association with a group does not, on its own, identify who controlled that tool in this particular campaign. The report supports a cautious distinction: malware and code overlap can inform attribution, while operator identity requires more than resemblance between tools.
Indicators defenders can investigate
Kaspersky’s indicators apply to the samples and activity covered by its report. They are leads for investigation, not universal signatures for every version of these malware families.
- Large DLLs in a public user directory: Look for relatively large DLL files—over 5 MB—in
C:UsersPublic, alongside unexpected or recurring Dropbox access, as possible clues to the Dropbox-connected backdoor. - Unsigned
msedgeupdate.dll: Kaspersky identifies an unsigned file with this name as a possible GrewApacha indicator. Validate the signature and file context rather than relying on the filename alone. - Unexpected per-user
msiexec.exeactivity: Kaspersky flagsmsiexec.exelaunched for each signed-in user as strong evidence associated with PlugY. - Named pipe
\.PIPEY: A pipe matching this name is another strong PlugY indicator in Kaspersky’s report.
Defenders should correlate these signals with the process tree, file origin, signing status, network and cloud-service logs, and timing. A single Dropbox connection, a common executable name, or a suspicious-looking file is not enough to establish this campaign; the value comes from linking the indicators to abnormal execution and related activity.
Rank #4
Sources and scope
Kaspersky’s 14 August 2024 analysis is the primary technical source for the chain, behaviors, and indicators: EastWind campaign: new CloudSorcerer attacks on government organizations in Russia. The report concerns activity observed in late July 2024 and does not establish an exact victim total, infection rate, or financial loss.
The Hacker News published a campaign summary on 12 August 2024 that describes the RAR/LNK delivery: Russian Government Hit by EastWind Attack Using Booby-Trapped LNK Files. Broadcom/Symantec’s April 2025 white paper provides later corroboration for the malware names and broad sequence: Relentless Force: China-Linked Espionage Actors White Paper.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
