Loading malware…
WebDav-O is a Windows backdoor used for cyberespionage, remote command execution, and data theft. It abuses legitimate cloud storage services, including Yandex Disk, Dropbox, and Mail services, for command-and-control file exchange. Its Yandex variant supports uploading and downloading files and executing arbitrary commands through the Windows command interpreter. The malware conceals its activity by masquerading as a Windows system component and disguising network traffic as legitimate cloud-storage communications. It has also been designed to evade Kaspersky antivirus detection.
WebDav-O has been deployed against Russian government organizations and government-linked targets in Belarus. Intrusion campaigns deploying it have used spearphishing, exploitation of web application vulnerabilities, and compromises of government contractors to obtain access before installing the backdoor. These operations collected confidential information from mail servers, document management systems, file servers, and workstations. WebDav-O has been associated with TaskMasters, while artifacts from a separate incident involving the malware have been linked to CoughingDown.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The technique is not new, having been deployed by the TaskMasters group in its Webdav-O malware.”
In 2022, our systems detected an attack employing malware known as WebDav-O that targeted a government agency in Russia.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
To get initial access to the victim, the attacking group exploited a vulnerability in IIS Windows Server.
After a complete compromise of the infrastructure, the attackers proceeded to collect confidential information from all sources of interest... and workstations of various levels.
After a complete compromise of the infrastructure, the attackers proceeded to collect confidential information from all sources of interest: such as mail servers, electronic document management servers, file servers, and workstations of various levels.
Detailed analysis of the tools showed the use of the Yandex.Disk service as the C2 server.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another malware component described elsewhere, but not analyzed in this content.
Mentioned as a historical comparison for using a legitimate cloud service as command-and-control infrastructure to bypass network defenses. The report associates Webdav-O with TaskMasters but does not identify it as part of the analyzed APT31 campaign.
A stealthy backdoor used after compromise to execute commands on infected hosts and steal confidential data. It exfiltrated data to command-and-control infrastructure via Yandex.Disk and was designed to bypass Kaspersky antivirus while disguising traffic as legitimate Yandex.Disk application communications.
Backdoor/implant used for cyberespionage. It communicates with cloud services such as Yandex Disk to receive encrypted commands, upload/download files, and execute arbitrary shell commands on compromised hosts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.