TaskMasters

TaskMasters is a cyberespionage group identified in 2018, with observed activity dating back to at least 2010. It has compromised more than 30 organizations across multiple countries, with a significant concentration of victims in Russia and the Commonwealth of Independent States. Its targets primarily include manufacturing and industrial organizations, alongside energy, government, technology, software development, systems integration, transport and logistics, real estate, and construction. Its objectives are theft of confidential documents and sustained access to executive workstations, key servers, and business-critical systems. Its country of origin and state sponsorship have not been definitively established. The group takes its name from its use of Windows Task Scheduler for lateral movement, particularly through the AtNow utility. Operations involve internal reconnaissance, vulnerability exploitation, credential extraction, remote command execution, and progression from workstations to domain controllers and file and application servers. TaskMasters combines publicly available tools such as Mimikatz, PWDump, GsecDump, NbtScan, PSExec, and WinRAR with custom utilities for document discovery, email extraction, file copying, archiving, and exfiltration. Supply-chain attacks are also part of its activity. Its principal malware family, RemShell, includes a downloader and a command-execution backdoor supporting file transfers. RemShell uses an intermediary server to obtain its main command-and-control address and protects communications with RC4 encryption and Base64 encoding. TaskMasters maintains backup access through web shells on externally accessible systems, including Exchange servers, and uses a custom web shell that disguises its authentication interface as an IIS error page. Additional evasion techniques include timestamp manipulation and encrypted command logs. The group also uses Webdav-O malware to communicate through a legitimate service to bypass network defenses.