Sofacy APT Adopts New Tactics and Far East Targets

itman · Mar 9, 2018

CANCUN, Mexico – A new analysis of the Russian-speaking Sofacy APT gang shows a continual march toward Far East targets and overlapping of activities with other groups such as Lamberts, Turla and Danti.

Researchers at Kaspersky Lab this morning at its Security Analyst Summit, released their update on Sofacy, also known as APT28, Fancy Bear, Sednit and a handful of other monikers. The report shows how Sofacy is continuing to evolve in 2018.

Most intriguing to researchers is the overlap between Sofacy and the English-speaking threat actor behind the Lamberts, also known as Longhorn. Researchers made the discovery connecting the two APTs when the presence of Sofacy was found on a server in China belonging to a company with ties to the aerospace and defense industry. The server was previously identified as compromised by Grey Lambert malware.

In this case, Sofacy’s SPLM (aka Xagent, aka CHOPSTICK) tool was found on the server, but it’s unclear what tactics were used by the APT to plant the malware. Researchers theorize a PowerShell script or legitimate but vulnerable web app was exploited to load and execute the SPLM code.
Click to expand...

https://threatpost.com/sofacy-apt-adopts-new-tactics-and-far-east-targets/130337/

Minimalist · Apr 28, 2018

Researchers Dissect Tool Used by Infamous Russian Hacker Group

ESET security researchers have taken a deep dive into one of the tools heavily used by the Russian threat actor Sofacy over the past couple of years.

Dubbed Zebrocy, the tool serves as a first-stage malware in attacks and is comprised of a Delphi downloader, an AutoIt downloader and a Delphi backdoor. Used in multiple attacks, the malicious program often acts as a downloader for the actor’s main backdoor, Xagent.
Click to expand...

https://www.securityweek.com/researchers-dissect-tool-used-infamous-russian-hacker-group

Minimalist · Nov 20, 2018

Sednit: What’s going on with Zebrocy?

The Sednit group has been operating since at least 2004, and has made headlines frequently in past years: it is believed to be behind major, high profile attacks. For instance, the US Department of Justice named the group as being responsible for the Democratic National Committee (DNC) hack just before the US 2016 elections. The group is also presumed to be behind the hacking of global television network TV5Monde, the World Anti-Doping Agency (WADA) email leak, and many others. This group has a diversified set of malware tools in its arsenal, several examples of which we have documented previously in our Sednit white paper from 2016.
Click to expand...

https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/

guest · Nov 29, 2018

Accenture: Russian hackers using Brexit talks to disguise phishing lures
November 29, 2018
https://www.cyberscoop.com/apt28-brexit-phishing-accenture/

A notorious Russian hacking group tried to exploit the latest flurry of Brexit-related news to spread malware to unsuspecting victims, according to a report from Accenture released Thursday.

APT28, which Accenture refers to as SNAKEMACKEREL, used a malware-laced Microsoft Word document [...] The name of the Word document used in the campaign is “Brexit 15.11.2018.docx,” suggesting that the Russian hacking group is exploiting current events to make its messages seem legitimate. [...] unleashing the “Zekapab” malware.

Zekapab [...] is a first-stage malware that establishes a backdoor on a victim’s system and collects information about the host. The malware is also known as Zebrocy

“The use of weaponized Microsoft Office documents to deliver first stage malware such as Zekapab (aka Zebrocy) and the use of news headline themes for document lures are hallmarks of SNAKEMACKEREL’s modus operandi,” Yip said.
Click to expand...

guest · Dec 19, 2018

Russia-Linked Sofacy Debuts Fresh Zebrocy Malware Variant
December 18, 2018
https://threatpost.com/russia-linked-sofacy-debuts-fresh-zebrocy-malware-variant/140064/

The Zebrocy trojan – a custom downloader malware used by Russia-linked APT Sofacy (a.k.a. APT28, Fancy Bear or Sednit) – has a new variant. While it’s functionally much the same as its other versions, the new code was written using the Go programming language.

“Past Zebrocy variants have been developed in AutoIt, Delphi, VB.NET, C# and Visual C++,” said developers at Unit 42, in a posting on Tuesday.
Now, the tactics seem to have evolved to use the new Zebrocy variant.

“Like the Dear Joohn attacks, the delivery document downloads a remote template via HTTP,” the researchers explained. “Upon opening the delivery document, the lure image … attempts to trick the recipient into enabling content to run the macro within the downloaded remote template.”
Click to expand...

Minimalist · Jan 11, 2019

A Zebrocy Go Downloader

Last year at SAS2018 in Cancun, Mexico, “Masha and these Bears” included discussion of a subset of Sofacy activity and malware that we call “Zebrocy”, and predictions for the decline of SPLM/XAgent Sofacy activity coinciding with the acceleration of Zebrocy activity and innovation. Zebrocy was initially introduced as a Sofacy backdoor package in 2015, but the Zebrocy cluster has carved a new approach to malware development and delivery to the world of Sofacy. In line with this approach, we will present more on this Zebrocy innovation and activity playing out at SAS 2019 in Singapore.
Click to expand...

https://securelist.com/a-zebrocy-go-downloader/

guest · Jan 24, 2019

GreyEnergy’s overlap with Zebrocy
January 24, 2019
https://securelist.com/greyenergys-overlap-with-zebrocy/89506/

Kaspersky Lab ICS CERT has identified an overlap between GreyEnergy and a Sofacy subset called “Zebrocy”. The Zebrocy activity was named after malware that Sofacy group began to use since mid-November 2015 for the post-exploitation stage of attacks on its victims. Zebrocy’s targets are widely spread across the Middle East, Europe and Asia and the targets’ profiles are mostly government-related.

Both sets of activity used the same servers at the same time and targeted the same organization.
Additionally, both GreyEnergy and Zebrocy spearphishing documents targeted a number of industrial companies in Kazakhstan.
Conclusions
Though no direct evidence exists on the origins of GreyEnergy, the links between a Sofacy subset known as Zebrocy and GreyEnergy suggest that these groups are related, as has been suggested before by some public analysis.
Click to expand...

guest · Jan 30, 2019

Sofacy’s Zepakab Downloader Spotted In-The-Wild
January 29, 2019
https://blog.yoroi.company/research/sofacys-zepakab-downloader-spotted-in-the-wild/

In the last weeks, the Cybaze-Yoroi ZLAB investigated a new APT28 campaign discovered in January 2019. The sample has been initially identified by an Italian independent security researcher, who warned the InfoSec community and shared the binary for further analysis.

Interestingly, the resource section of the executable shows a typical binary pattern of the AutoIt v3 compiled script: the “AUT3!” signature.
The usage of AutoIt language is an emerging characteristic of recent Zepakab downloaders, as also stated by Vitali Kremez, independent security researcher [...] the AutoIT WinHttp wrapper was included into the malicious sample to enable network communication through system proxy.

Despite its harmful capabilities, the AutoIt Zepakab malware is quite simple and surprisingly does not use any anti-analysis tricks. [...] building a cheap and effective info-stealer malware able to bypass traditional antivirus, almost effortless.
Click to expand...

guest · May 22, 2019

Zebrocy Operators Also Look for Browser and Email Databases
May 22, 2019
https://www.bleepingcomputer.com/ne...rs-also-look-for-browser-and-email-databases/

Zebrocy is a toolkit composed of a set of downloaders, droppers, and backdoors associated with an advanced threat group known as Sednit, APT28, Fancy Bear, Sofacy or STRONTIUM that runs cyber-espionage operations.
Luring the victim
It is believed that the URL reached the victim via spearphishing emails, although the researchers have yet to recover a sample of a malicious message.
Commands run minutes after infection
After infecting a system, the malware sends out basic information about the host, which signals Zebrocy operators that they can start sending commands; this happens in minutes.

To get to the information of interest, Zebrocy operators upload on the target machines tools that collect login credentials nad private keys from web browsers (Yandex Browser, Chromium, 7Star Browser (a Chromium-based browser), CentBrowser, and versions of Microsoft Outlook from 1997 through 2016.
The malware looks for databases from other programs, as well. Firefox and Opera browsers, and email client The Bat! are among the targeted software.
Click to expand...

ESET: A journey to Zebrocy land

guest · Jun 3, 2019

Zebrocy’s Multilanguage Malware Salad
June 3, 2019
https://securelist.com/zebrocys-multilanguage-malware-salad/90680/

We originally described a rare “Zebrocy Delphi payload” in late 2015 private reports. That malware set, activity, and infrastructure has greatly expanded.

Essentially, in our SAS2019 presentation “Zebrocy’s Multilanguage Malware Salad”, we publicly provided for the first time original insights on Zebrocy and its characteristics, based on five years of research and private reports on this group
While Zebrocy has never presented 0day exploits, this group’s lineage comes from not-so-humble BlackEnergy and Sofacy beginnings. The group presents an agile and capable malware set, it spearphishing and intrusion activity surged in volume in 2018, and their efficacy requires network defenders’ attention.
Click to expand...

guest · Sep 24, 2019

Political targets at risk as Fancy Bear returns with refreshed backdoor malware
The threat group’s attack chain is now even heavier with a string of malicious payloads
September 24, 2019
https://www.zdnet.com/article/polit...bear-returns-with-refreshed-backdoor-malware/

A recent attack campaign launched by Fancy Bear has revealed an updated set of tools including a backdoor written in a new language.
Fancy Bear, also known as APT28, Sednit, Sofacy, and Strontium, is an advanced persistent threat (APT) group which has been connected to an array of politically-motivated attacks.

A new Fancy Bear campaign has been discovered by ESET. Launched at victims on the usual hit-list -- including Ministries of Foreign Affairs and embassies across Europe and Asia -- and tracked in August, the group is making use of phishing emails tied with heavy malicious payloads as well as a new backdoor system.
The cybersecurity researchers say this is the first time the Goland backdoor has been seen in campaigns
Click to expand...

ESET: No summer vacations for Zebrocy

guest · Sep 23, 2020

Russia-linked APT28 targets govt bodies with fake NATO training docs
September 23, 2020
https://securityaffairs.co/wordpress/108635/cyber-warfare-2/apt28-nato-training-docs.html

The Russia-linked cyberespionage group APT28 is behind a string of attacks that targeting government bodies with Zebrocy Delphi malware. The malicious code was distributed using fake NATO training materials as bait and had a very low detection rate of 3/61 on VirusTotal.

Threat intelligence firm QuoIntelligence uncovered a campaign on Government bodies on August 9, the attacks likely started on August 5.

“On 9 August, QuoIntelligence disseminated a Warning to its government customers about a new APT28 (aka Sofacy, Sednit, Fancy Bear, STRONTIUM, etc.) campaign targeting government bodies of NATO members (or countries cooperating with NATO).” reads the report published QuoIntelligence. “In particular, we found a malicious file uploaded to VirusTotal, which ultimately drops a Zebrocy malware and communicates with a C2 in France.”
According to QuoIntelligence researchers, the campaign targeted some NATO countries and at least one Middle Eastern country, Azerbaijan that cooperates with the North-Atlantic alliance.
Click to expand...

QuoIntelligence: APT28 Delivers Zebrocy Malware Campaign using NATO Theme as Lure

guest · Dec 10, 2020

Russian APT28 Hackers Using COVID-19 as Bait to Deliver Zebrocy Malware
December 9, 2020
https://thehackernews.com/2020/12/russian-apt28-hackers-using-covid-19-as.html

A Russian threat actor known for its malware campaigns has reappeared in the threat landscape with yet another attack leveraging COVID-19 as phishing lures, once again indicating how adversaries are adept at repurposing the current world events to their advantage.

Linking the operation to a sub-group of APT28 (aka Sofacy, Sednit, Fancy Bear, or STRONTIUM), cybersecurity firm Intezer said the pandemic-themed phishing emails were employed to deliver the Go version of Zebrocy (or Zekapab) malware.
The cybersecurity firm told The Hacker News that the campaigns were observed late last month.
Click to expand...

This specific campaign spotted by Intezer uses the Go version of the malware, first documented by Palo Alto Networks in October 2018 and later by Kaspersky in early 2019, with the lure delivered as part of a Virtual Hard Drive (VHD) file that requires victims to use Windows 10 to access the files.
Click to expand...

Intezer: A Zebra in Gopher's Clothing: Russian APT Uses COVID-19 Lures to Deliver Zebrocy

Summary
In November, we uncovered COVID-19 phishing lures that were used to deliver the Go version of Zebrocy. Zebrocy is mainly used against governments and commercial organizations engaged in foreign affairs. The lures consisted of documents about Sinopharm International Corporation—a pharmaceutical company that COVID-19 vaccine is currently going through phase three clinical trials—and an impersonated evacuation letter from Directorate General of Civil Aviation.

The lure was delivered as part of a Virtual Hard Drive (VHD) file that requires victims to use Windows 10 to access the files. While the malware samples were heavily obfuscated, it was possible to attribute them to the Sofacy threat actor since they shared genomes with samples used in previous campaigns.
Click to expand...

Log in or Sign up

Sofacy APT Adopts New Tactics and Far East Targets

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Sofacy APT Adopts New Tactics and Far East Targets

itman Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches