Potao Express

Potao Express is a hacking group that is known for two tools, which they have developed – FakeTC and Potato. This hacking group has been active since 2011, but malware researchers have been observing their activities closely since 2017.

FakeTC

The FakeTC malware is a fraudulent copy of the legitimate tool called ‘TrueCrypt.’ The authors of the FakeTC malware are propagating it using a Russian website. The attackers only pick certain users who they target, and only these targets would receive the FakeTC malware while all the other users will get TrueCrypt, the genuine application. This way, the creators of the FakeTC malware are more likely to remain under the radar of security experts. The FakeTC threat provides the attackers with information about the victims. The authors of the FakeTC malware are also able to execute other tasks on the infiltrated host. The FakeTC malware is deployed as a first-stage payload traditionally.

Potao

The Potao threat is a backdoor Trojan that enables the attackers to plant additional malware on the compromised machine. This can either be achieved via executing files that are already present on the system or downloading and executing files from the Web. The Potao copies tend to be delivered by the FakeTC threat.

Not Much Has Changed Since 2011

One of the first tools used by the Potao Express hacking group is the Potao malware, which has been a part of their arsenal since 2011. The Potao Express group tends to concentrate its efforts on targets in ex-Soviet countries – Ukraine, Russia, Belarus and Georgia. However, the Potao Express hacking group appears to be targeting media corporations and military bodies located in Ukraine, mainly. The individuals behind the Potao Express group also target an organization called MMM, which runs a Ponzi scheme in Russia and Ukraine. It is known that the Potao Express hacking group has used fake SMS messages carrying a corrupted link. The link was masquerading as a delivery tracking website. However, this is not the only infection vector employed by the Potao hacking group as they tend to change their propagation methods regularly.

The Potao Express group has been operating for at least eight years now, but their campaigns are too far apart for malware researchers to get a better understanding of the individuals behind the campaigns. There are speculations that the Potao Express hacking group originates from Russia, but there has not been enough evidence to support this claim. The Potao Express group is not among the most high-end hacking groups, but they are still capable of causing a fair bit of damage to their targets.