Shedding Zmiy

Shedding Zmiy is an Eastern European, pro-state threat group active against Russian organizations since at least 2022. It is associated with the ExCobalt activity cluster and cyberespionage operations targeting government, metallurgy, mining, telecommunications, information technology, and software development organizations. No specific country of origin or sponsoring government has been established. The group exploits internet-facing applications and abuses contractor relationships to compromise target environments. In one intrusion through a contractor, it exploited Log4j vulnerabilities CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105 in YouTrack before compromising Microsoft Exchange and stealing ASP.NET VIEWSTATE validation and decryption keys. Its custom Python framework BADSTATE uses these keys to deliver malicious serialized VIEWSTATE payloads and load the ViewStateExecutor .NET web shell into IIS worker-process memory. The framework supports reconnaissance, command execution, file transfer and manipulation, and in-memory execution of additional .NET assemblies. It can also deploy virtual web shells through ASP.NET VirtualPathProvider without creating corresponding web-shell files on disk, including tunnels using Neo-reGeorg. Associated ExCobalt operations use the GoRed backdoor, also reported as Bulldog Backdoor in Shedding Zmiy investigations. GoRed provides credential monitoring, host and network reconnaissance, encrypted command-and-control, reverse shells, proxying, filesystem monitoring, persistence, and data exfiltration. The associated toolset includes privilege-escalation exploits, credential-dumping utilities, remote-access tools, and web shells. Defense-evasion techniques include obfuscation, in-memory payload execution, and modified Linux utilities that conceal malicious processes and network connections. Tool and infrastructure overlaps with other Russia-targeting groups do not establish that those groups are aliases or subgroups of Shedding Zmiy.