Full Report
Operation Silent Rotor: Targeted Campaign Compromises Unmanned Aviation Sector Ahead of Moscow Summit Table of Content Introduction Key Targets Industries Affected Geographical focus Infection Chain Initial Findings Looking into the Decoy Documents Technical Analysis Stage 1 – Analysis of Malicious Executable Stage 2 – Second stage payload dropper Infrastructure & Attribution Conclusion Seqrite Protection Indicators […] The post Operation Silent Rotor: Targeted Campaign Compromises Unmanned Aviation Sector Ahead of Moscow Summit appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Incident Report: Operation Silent Rotor
## Executive Summary
Operation Silent Rotor is a targeted cyber-espionage campaign aimed at the unmanned aviation (UAS/UAV) and aeronautical sectors in Eurasia. The campaign utilized sophisticated Rust-based malware and industry-specific decoy documents to impersonate the Russian Aeronautical Information Center (CAI) ahead of a major aviation summit in Moscow. The primary outcome was the successful delivery of a multi-stage dropper designed to collect system information and deploy further malicious payloads.
## Incident Details
- **Discovery Date:** May 06, 2026 (Report Date)
- **Incident Date:** April 2026 (Timed around the April 23 summit)
- **Affected Organization:** Unspecified organizations in the UAS sector
- **Sector:** Unmanned Aviation Systems (UAS), Defense, Aeronautical Services
- **Geography:** Russia, Tajikistan, Central Asia, Middle East, and Europe
## Timeline of Events
### Initial Access
- **Date/Time:** April 2026
- **Vector:** Spear-phishing email
- **Details:** Attackers distributed a ZIP archive (`cai partner.zip`) containing a malicious Rust-based executable disguised as a product order confirmation from the CAI.
### Lateral Movement
- **Details:** The initial stage focused on system profiling and reconnaissance; specific lateral movement techniques within the reported phase were focused on establishing a foothold for further payload delivery.
### Data Exfiltration/Impact
- **Details:** The malware performed system information discovery, including network configuration and user details. It reached out to a C2 server to exfiltrate this metadata and download a more advanced second-stage payload.
### Detection & Response
- **How it was discovered:** SEQRITE Labs identified suspicious submissions on VirusTotal with zero initial detections, followed by proactive hunting of the "cai partner" naming convention.
- **Response actions:** Technical analysis of the binary, infrastructure mapping, and publication of Indicators of Compromise (IoCs).
## Attack Methodology
- **Initial Access:** Spearphishing Attachment (T1566.001) using social engineering themed around the "Unmanned Aviation 2026" forum.
- **Persistence:** Implementation of a second-stage payload dropper to maintain access.
- **Defense Evasion:** Use of the Rust programming language (to bypass signature-based detection), file masquerading (using legitimate-looking icons and names), and obfuscation of malicious strings.
- **Discovery:** System Information Discovery (T1082), System Network Configuration Discovery (T1016), and File/Directory Discovery (T1083).
- **Lateral Movement:** Not explicitly detailed in this phase, though the infrastructure supported ingress tool transfer.
- **Exfiltration:** Exfiltration over C2 channel (T1041) using HTTPS.
- **Impact:** Potential for long-term espionage and intellectual property theft related to UAS technology.
## Impact Assessment
- **Financial:** Unknown; potential loss of competitive advantage in the UAS market.
- **Data Breach:** System metadata, network architecture details, and user credentials.
- **Operational:** Disruption of secure communications and potential compromise of aviation-related documents.
- **Reputational:** Misuse of the Russian Aeronautical Information Center (CAI) brand to lure victims.
## Indicators of Compromise
### Network Indicators
- 45[.]142[.]36[.]76
- hxxp://cdn[.]kleymarket[.]ru
### File Indicators (SHA-256)
- `5936f42ffd7fa7896eeae725b60a5d26bbf3e5a84712671ef5da0138ee5d58f60` (Malicious Executable)
- `57e26f6e3b311a1064c946b69159ee05abedf9228b2f95c65536429e7ac7fb24` (Source ZIP)
- `a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202` (PDF Lure)
## Response Actions
- **Containment:** Blocked communication with identified C2 domains and IPs.
- **Eradication:** Detection rules (Trojan.Win64) updated for Seqrite protection modules.
- **Recovery:** Organizations advised to scan for the presence of the identified file hashes and unauthorized outgoing connections to `.ru` domains.
## Lessons Learned
- **High-Value Event Targeting:** Threat actors capitalize on specific international summits to create highly convincing social engineering lures.
- **Language-Specific Lures:** The use of precise industry terminology and multilingual documents (Russian/Tajik/English) significantly increases the success rate of the initial compromise.
- **Adoption of Rust:** The move toward "exotic" languages like Rust for malware development continues to challenge traditional AV solutions.
## Recommendations
- **Technical:** Implement EDR solutions capable of detecting behavioral anomalies in compiled binaries (like Rust/Go) rather than relying solely on file signatures.
- **Security Awareness:** Conduct targeted phishing simulations for employees attending or interested in industry forums and summits.
- **Policy:** Restrict the execution of unknown binaries from ZIP attachments and implement strict "Mark of the Web" (MotW) controls for office documents and archives.