Russian APT comes back to life with new US spear-phishing campaign

guest · Nov 17, 2018

Russian APT comes back to life with new US spear-phishing campaign
Cozy Bear (APT29) makes a comeback after last year's Dutch and Norwegian hacking campaigns
November 16, 2018
https://www.zdnet.com/article/russian-apt-comes-back-to-life-with-new-us-spear-phishing-campaign/

"On 14 November 2018, CrowdStrike detected a widespread spear-phishing campaign against multiple sectors," Adam Meyers, VP of Intelligence told ZDNet today.

However, CrowdStrike was just one of the many cyber-security firms that picked up this week's APT29 activities. FireEye and other members of the cyber-security industry have been analyzing and tearing apart the spear-phishing campaign on Twitter all week [1, 2, 3].

FireEye, in particular, confirmed that 20 of its customers had received Cozy Bear's spear-phishing emails [...]
The spear-phishing campaign came out of nowhere and surprised most security experts. Before this week's discoveries, the group had been silent for more than a year.
Click to expand...

guest · Oct 17, 2019

Cybersecurity warning: This sophisticated Russian hacking group is back in action again
October 17, 2019
https://www.zdnet.com/article/cyber...ussian-hacking-group-is-back-in-action-again/

A Russian cyber espionage operation which was one of the groups which hacked into Democratic National Committee in the run-up to the 2016 US Presidential election has been busy with attacks against government departments across Europe and beyond.

The Cozy Bear hacking group – also known as APT29 [...] In the time since then, Cozy Bear appeared to go quiet, but now cyber security analysts at ESET have detailed how the group – which they refer to as Dukes – have continued their activity while attempting to staying under the radar.
Like other campaigns by Cozy Bear, attacks begin with targeted spear-phishing emails designed to lure victims into clicking a malicious link or downloading malware via an attachment – however the initial compromise emails haven't yet been identified.
Click to expand...

The campaigns also use three new families of malware to help conduct operations on compromised systems, which researchers have named PolyglotDuke, RegDuke and FatDuke.

PolyglotDuke uses Twitter, Reddit, Imgur and other websites to link to their command and control (C&C) infrastructure, enabling the attackers to avoid storing this information in the malware – something which can be helpful for avoiding detection.

"Finally, it allows attackers to easily update the C&C URL as they just need to replace the message," he added.
Click to expand...

ESET: Operation Ghost: The Dukes aren’t back – they never left

guest · Jul 19, 2022

Russian hacking unit Cozy Bear adds Google Drive to its arsenal, researchers say
July 19, 2022

The state-backed Russian hacking team behind some of the biggest digital intrusions in recent years has been using both Google Drive and Dropbox to deliver malware against a range of targets, researchers said Tuesday.

Researchers with Palo Alto Networks’ Unit 42 threat intelligence team said Tuesday that the Russian Foreign Intelligence Service (SVR) hacking unit — known as Cloaked Ursa by Unit 42, but more generally as APT29 or Nobelium or Cozy Bear — had previously used legitimate cloud services such as Dropbox as part of malware delivery efforts.
Click to expand...

But in a series of spear phishing attacks dating back to early May, the hackers have demonstrated “sophistication and the ability to rapidly integrate popular cloud storage services to avoid detection,” most notably by mixing Google Drive’s cloud storage services into their mix.

“This is a new tactic for this actor and one that proves challenging to detect due to the ubiquitous nature of these services and the fact that they are trusted by millions of customers worldwide,” the researchers said.
“Google’s ubiquity, combined with the trust that millions of customers worldwide have in them, make their inclusion into this APT’s malware delivery process exceptionally concerning,” the researchers said.
Click to expand...

Palo Alto Networks - Unit42: Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

Organizations around the world rely on the use of trusted, reliable online storage services – such as DropBox and Google Drive – to conduct day-to-day operations. However, our latest research shows that threat actors are finding ways to take advantage of that trust to make their attacks extremely difficult to detect and prevent.

When the use of trusted services is combined with encryption, as we see here, it becomes extremely difficult for organizations to detect malicious activity in connection with the campaign.
Click to expand...

Log in or Sign up

Russian APT comes back to life with new US spear-phishing campaign

guest Guest

guest Guest

guest Guest

Log in or Sign up

Russian APT comes back to life with new US spear-phishing campaign

guest Guest

guest Guest

guest Guest

Useful Searches