Spica

Executive Summary

Spica is a Rust‑based Windows backdoor linked to the Star Blizzard actor, deploying covertly as a service and establishing encrypted C2 channels. Its primary functions include remote execution, data exfiltration, and persistence across reboots. Early indicators point to sophisticated evasion tactics, such as binary packing and minimal external dependencies.

Spica is a custom Windows backdoor authored in Rust, identified through recent public threat hunting activity (Google TAG COLDRIVER January 2024). The code base appears to be designed for covert persistence and remote command execution, mirroring the tactics employed by its associated actor known as Star Blizzard. Initial samples indicate that Spica installs itself in a privileged context, often deploying as a Windows service or using scheduled tasks to ensure continuity across reboots. The backdoor’s Rust implementation confers several advantages: static linking reduces reliance on external DLLs, making it more resilient against dependency‑based detection; the binary is typically compiled with optimization flags that strip symbolic information, complicating reverse engineering. Spica communicates outward via TLS‑encrypted channels to a hard‑coded command‑and‑control (C2) server, using HTTP or HTTPS payloads that mimic legitimate traffic patterns. Beyond remote code execution, preliminary analyses suggest Spica can exfiltrate collected files and system metadata, enumerate network connections, and possibly piggyback on PowerShell for lateral movement. While the full breadth of its capabilities remains to be confirmed, the observable behavior aligns with typical credential‑stealer or backdoor families seen in modern APT campaigns.

Key Capabilities

• Performs stealthy installation via Windows services or scheduled tasks
• Establishes encrypted (TLS/HTTPS) C2 communications
• Executes arbitrary commands received from the attacker
• Exfiltrates collected files and system metadata
• Packs the binary to avoid signature‑based detection
• Potentially utilizes PowerShell for lateral movement

ATT&CK Techniques

Recommended Actions

• Deploy host‑based intrusion detection systems tuned to detect unusual service creation or scheduled task modifications on Windows
• Insist on strict TLS cert pinning to flag mismatched or self‑signed certificates used by C2 endpoints
• Implement network segmentation and anomaly monitoring for outbound HTTPS traffic to unfamiliar domains
• Use antivirus solutions that include behavioral analytics capable of detecting binary packing and encrypted command streams
• Apply the principle of least privilege, ensuring applications run with the minimal required permissions

Suggested Tags