Lorec53

Profile narrative

Lorec53 is a threat actor alias associated with a Russian state‑linked hacking group that operates from Russia. The group has been observed targeting Ukrainian governmental entities, specifically compromising central and local government websites. Its typical initial access involves the use of a previously planted web shell that remains dormant for extended periods before being activated. Once the web shell is accessed, the actor deploys a suite of backdoors identified as CredPump, HoaxPen, and HoaxApe to maintain persistence and enable further intrusion. To conceal its traffic and facilitate malware delivery, the group employs GOST encryption and Ngrok tunneling tools. Public attribution notes a clear nexus to Russian state interests.

The most publicly reported operation linked to Lorec53 occurred on 23 February 2023, when the group exploited a year‑old web shell to infiltrate multiple Ukrainian government portals and install the CredPump, HoaxPen, and HoaxApe backdoors, using GOST and Ngrok to tunnel communications. Beyond this incident, the actor has a documented history of conducting phishing campaigns against Ukrainian organizations and delivering various backdoors to gain persistent access. These activities demonstrate a pattern of focusing on Ukrainian targets while also showing coordination with Russian state‑directed operations that extend to entities in North America and Western Europe. The combination of long‑lived web shells, specific malware families, and tunneling utilities constitutes the core of Lorec53’s observed tradecraft.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.