“Graphiron”, a new information-stealing malware, has recently been observed in attacks targeting an array of Ukrainian organizations. The attacks are being launched by the Russian espionage group Nodaria (aka UAC-0056), who has been active since at least March of 2021. Graphiron is written in the Golang programming language and is designed to “harvest a wide range of information from the infected computer, including system information, credentials, screenshots, and files.” The earliest evidence of this malware is cited to be from October 2022 and is comprised of two stages: a downloader and a payload. The downloader checks for various malware analysis tools once executed, and if no tools are found, it connects to a hardcoded command-and-control (C2) server in order to download and decrypt the payload. Then, the payload is added to an autorun location for persistence. Researchers noted that the downloader makes just one (1) attempt to download and install the payload, meaning it won’t make additional attempts if it fails or sends a heartbeat. Graphiron uses hardcoded file names designed to disguise themselves as Microsoft Office, such as “OfficeTemplate.exe” and “MicrosoftOfficeDashboard.exe”. Graphiron is noted to have similarities to other malware used by the Nodaria group, including “GraphSteel” and “GrimPlant”, and is constantly evolving its capabilities in order to evade defensive measures. Additional information on the Nodaria threat group as well as indicators of compromise (IOCs) can be viewed in Symantic’s report linked below.