Latrodectus and Supper in Poland

Summary

CERT Polska assisted law enforcement after an intrusion at a large Polish organisation, and traced the way in to one user who obeyed a bogus human-verification page. The instruction was to paste a line into the Windows Run box; it fetched content with curl and piped it into PowerShell. The payload was a DLL side-loaded by a legitimate Intel executable in an %APPDATA% folder, unpacking to Latrodectus version 2.3 and tagged internally with the group name Kallichore; the analysts found no public account of the 2.x branch. Two further DLLs taken off the same workstation unpacked to Supper, a backdoor CERT Polska associates with the run-up to ransomware, persisting as a scheduled task named to resemble a Google updater. The report does not establish which stage put the Supper files on the machine, only that the intrusion began at the verification page.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 12 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

15 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.