Ensuring that applications and operating systems are patched with the latest updates greatly reduces the number of exploitable entry points available to an attacker .


Use best practices when updating software and patches by only downloading updates from authenticated vendor sites .


Use application whitelisting .


Whitelisting is one of the best security strategies because it allows only specified programs to run while blocking all others , including malicious software .


Restrict administrative privileges .


Threat actors are increasingly focused on gaining control of legitimate credentials , especially credentials associated with highly privileged accounts .


Reduce privileges to only those needed for a user 's duties .


Separate administrators into privilege tiers with limited access to other tiers .


Segment networks and segregate them into security zones .


Segment networks into logical enclaves and restrict host-to-host communications paths .


This helps protect sensitive information and critical services , and limits damage from network perimeter breaches .


Validate input .


Input validation is a method of sanitizing untrusted input provided by users of a web application .


Implementing input validation can protect against the security flaws of web applications by significantly reducing the probability of successful exploitation .


Types of attacks possibly averted include Structured Query Language ( SQL ) injection , cross-site scripting , and command injection .


Use stringent file reputation settings .


Tune the file reputation systems of your anti-virus software to the most aggressive setting possible .


Some anti-virus products can limit execution to only the highest reputation files , stopping a wide range of untrustworthy code from gaining control .


Understand firewalls .


Firewalls provide security to make your network less susceptible to attack .


They can be configured to block data and applications from certain locations ( IP S-PROT whitelisting ) , while allowing relevant and necessary data through .


To protect against code injections and other attacks , system operators should routinely evaluate known and published vulnerabilities , periodically perform software updates and technology refreshes , and audit external-facing systems for known web application vulnerabilities .


They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector .


Use and configure available firewalls to block attacks .


Take steps to secure Windows systems , such as installing and configuring Microsoft 's Enhanced Mitigation Experience Toolkit ( EMET ) and Microsoft AppLocker .


Monitor and remove any unauthorized code present in any www directories .


Disable , discontinue , or disallow the use of Internet Control Message Protocol ( ICMP ) and Simple Network Management Protocol ( SNMP ) as much as possible .


Remove unnecessary HTTP verbs from web servers .


Typical web servers and applications only require GET , POST , and HEAD .


Where possible , minimize server fingerprinting by configuring web servers to avoid responding with banners identifying the server software and version number .


Secure both the operating system and the application .


Update and patch production servers regularly .


Disable potentially harmful SQL-stored procedure calls .


Sanitize and validate input to ensure that it is properly typed and does not contain escaped code .


Consider using type-safe stored procedures and prepared statements .


Audit transaction logs regularly for suspicious activity .


Perform penetration testing on web services .


Ensure error messages are generic and do not expose too much information .


System operators should take the following steps to limit permissions , privileges , and access controls .


Reduce privileges to only those needed for a user 's duties .


Restrict users' ability ( permissions ) to install and run unwanted software applications , and apply the principle of Least Privilege to all systems and services .


Restricting these privileges may prevent malware from running or limit its capability to spread through the network .


Carefully consider the risks before granting administrative rights to users on their own machines .


Scrub and verify all administrator accounts regularly .


Configure Group Policy to restrict all users to only one login session , where possible .


Enforce secure network authentication , where possible .


Instruct administrators to use non-privileged accounts for standard functions such as web browsing or checking webmail .


Segment networks into logical enclaves and restrict host-to-host communication paths .


Containment provided by enclaving also makes incident cleanup significantly less costly .


Configure firewalls to disallow Remote Desktop Protocol ( RDP ) traffic coming from outside of the network boundary , except for in specific configurations such as when tunneled through a secondary virtual private network ( VPN ) with lower privileges .


Audit existing firewall rules and close all ports that are not explicitly needed for business .


Specifically , carefully consider which ports should be connecting outbound versus inbound .


Enforce a strict lockout policy for network users and closely monitor logs for failed login activity .


Failed login activity can be indicative of failed intrusion activity .


If remote access between zones is an unavoidable business need , log and monitor these connections closely .


In environments with a high risk of interception or intrusion , organizations should consider supplementing password authentication with other forms of authentication such as challenge/response or multifactor authentication using biometric or physical tokens .


System operators should follow these secure logging practices .


Ensure event logging , including applications , events , login activities , and security attributes , is turned on or monitored for identification of security issues .


Configure network logs to provide adequate information to assist in quickly developing an accurate determination of a security incident .


Upgrade PowerShell to new versions with enhanced logging features and monitor the logs to detect usage of PowerShell commands , which are often malware-related .


Secure logs in a centralized location and protect them from modification .


Phantom of the Opaera :


New KASPERAGENT Malware Campaign .


ThreatConnect has identified a KASPERAGENT malware campaign leveraging decoy Palestinian Authority documents .


The samples date from April – May 2017 , coinciding with the run up to the May 2017 Palestinian Authority elections .


Although we do not know who is behind the campaign , the decoy documents ’ content focuses on timely political issues in Gaza and the IP address hosting the campaign ’s command and control node hosts several other domains with Gaza registrants .


In this blog post we will detail our analysis of the malware and associated indicators , look closely at the decoy files , and leverage available information to make an educated guess on the possible intended target .


Associated indicators and screenshots of the decoy documents are all available here in the ThreatConnect platform .


Some of the indicators in the following post were published on AlienVault OTX on 6/13 .


KASPERAGENT is Microsoft Windows malware used in efforts targeting users in the United States , Israel , Palestinian Territories , and Egypt since July 2015 .


The malware was discovered by Palo Alto Networks Unit 42 and ClearSky Cyber Security , and publicized in April 2017 in the Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA blog .


It is called KASPERAGENT based on PDB strings identified in the malware such as “ c : UsersUSADocumentsVisual Studio 2008ProjectsNew folder ( 2 ) kasperReleasekasper.pdb ” .


The threat actors used shortened URLs in spear phishing messages and fake news websites to direct targets to download KASPERAGENT .


Upon execution , KASPERAGENT drops the payload and a decoy document that displays Arabic names and ID numbers .


The malware establishes persistence and sends HTTP requests to the command and control domain mailsinfo.net .


Of note , the callbacks were to PHP scripts that included / dad5 / in the URLs .


Most samples of the malware reportedly function as a basic reconnaissance tool and downloader .


However , some of the recently identified files display “ extended-capability ”


including the functionality to steal passwords , take screenshots , log keystrokes , and steal files .


These “ extended-capability ”


samples called out to an additional command and control domain , stikerscloud.com .


Additionally , early variants of KASPERAGENT used “ Chrome ”


as the user agent , while more recent samples use “ OPAERA ”


– a possible misspelling of the “ Opera ”


– browser .


The indicators associated with the blog article are available in the ThreatConnect Technical Blogs and Reports source here .


The samples we identified leverage the same user agent string “ OPAERA ”


, included the kasper PDB string reported by Unit 42 , and used similar POST and GET requests .


The command and control domains were different , and these samples used unique decoy documents to target their victims .


We didn’t start out looking for KASPERAGENT , but a file hit on one of our YARA rules for an executable designed to display a fake XLS icon – one way adversaries attempt to trick targets into thinking a malicious file is innocuous .


The first malicious sample we identified ( 6843AE9EAC03F69DF301D024BFDEFC88 ) had the file name “ testproj.exe ”


and was identified within an archive file ( 4FE7561F63A71CA73C26CB95B28EAEE8 ) with the name “ التفاصيل الكاملة لأغتيال فقهاء.r24 ” .


This translates to “ The Complete Details of Fuqaha ’s Assassination ”


, a reference to Hamas military leader Mazen Fuqaha who was assassinated on March 24 , 2017 .


We detonated the file in VxStream ’s automated malware analysis capability and found testproj.exe dropped a benign Microsoft Word document that pulls a jpg file from treestower.com .


Malwr.com observed this site in association with another sample that called out to mailsinfo.net – a host identified in the Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA blog .


That was our first hint that we were looking at KASPERAGENT .


The jpg pulled from treestower.com displays a graphic picture of a dead man , which also appeared on a Palestinian news website discussing the death of Hamas military leader Mazen Fuqaha .


A separate malicious executable – 2DE25306A58D8A5B6CBE8D5E2FC5F3C5 ( vlc.exe ) – runs when the photograph is displayed , using the YouTube icon and calling out to several URLs on windowsnewupdates.com .


This host was registered in late March and appears to be unique to this campaign .


With our interest piqued , we pivoted on the import hashes ( also known as an imphash ) , which captures the import table of a given file .


Shared import hashes across multiple files would likely identify files that are part of the same malware family .


We found nine additional samples sharing the imphash values for the two executables , C66F88D2D76D79210D568D7AD7896B45 and DCF3AA484253068D8833C7C5B019B07 .


Analysis of those files uncovered two more imphashes , 0B4E44256788783634A2B1DADF4F9784 and E44F0BD2ADFB9CBCABCAD314D27ACCFC , for a total of 20 malicious files .


These additional samples behaved similarly to the initial files ;


testproj.exe dropped benign decoy files and started malicious executables .


The malicious executables all called out to the same URLs on windowsnewupdates.com .


These malware samples leverage the user agent string “ OPAERA ” , the same one identified in the Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA blog .


Although the command and control domain was different from those in the report , the POST and GET requests were similar and included / dad5 / in the URL string .


In addition , the malware samples included the kasper PDB string reported by Unit 42 , prompting us to conclude that we were likely looking at new variants of KASPERAGENT .


Several of the decoy files appeared to be official documents associated with the Palestinian Authority – the body that governs the Palestinian Territories in the Middle East .


We do not know whether the files are legitimate Palestinian Authority documents , but they are designed to look official .


Additionally , most of the decoy files are publicly available on news websites or social media .


The first document – dated April 10 , 2017 – is marked “ Very Secret ”


and addressed to Yahya Al-Sinwar , who Hamas elected as its leader in Gaza in February 2017 .


Like the photo displayed in the first decoy file we found , this document references the death of Mazen Fuqaha .


The Arabic-language text and English translation of the document are available in ThreatConnect here .


A screenshot of the file is depicted below .


The second legible file , dated April 23 , has the same letterhead and also is addressed to Yahya al-Sinwar .


This file discusses the supposed announcement banning the rival Fatah political party , which controls the West Bank , from Gaza .


It mentions closing the Fatah headquarters and houses that were identified as meeting places as well as the arrest of some members of the party .


We don’t know for sure who is responsible for this campaign , but digging into the passive DNS results led us to some breadcrumbs .


Starting with 195.154.110.237 , the IP address which is hosting the command and control domain windowsnewupdates.com , we found that the host is on a dedicated server .


Using our Farsight DNSDB integration , we identified other domains currently and previously hosted on the same IP .


Two of the four domains that have been hosted at this IP since 2016 — upfile2box.com and 7aga.net — were registered by a freelance web developer in Gaza , Palestine .


This IP has been used to host a small number of domains , some of which were registered by the same actor , suggesting the IP is dedicated for a single individual or group ’s use .


While not conclusive , it is intriguing that the same IP was observed hosting a domain ostensibly registered in Gaza AND the command and control domain associated with a series of targeted attacks leveraging Palestinian Authority -themed decoy documents referencing Gaza .


Just like we can’t make a definitive determination as to who conducted this campaign , we do not know for sure who it was intended to target .


What we do know is that several of the malicious files were submitted to a public malware analysis site from the Palestinian Territories .


This tells us that it is possible either the threat actors or at least one of the targets is located in that area .


Additionally , as previously mentioned , the decoy document subject matter would likely be of interest to a few different potential targets in the Palestinian Territories .


Potential targets such as Hamas who controls the Gaza strip and counts Mazen Fuqaha and Yahya al-Sinwar as members , Israel which is accused of involvement in the assassination of Mazen Fuqaha , and the Fatah party of which the Prime Minister and President of the Palestinian Authority are members .


The campaign corresponds with a period of heightened tension in Gaza .


Hamas , who has historically maintained control over the strip , elected Yahya al-Sinwar – a hardliner from its military wing – as its leader in February .


A Humanitarian Bulletin published by the United Nations ’ Office for the Coordination of Humanitarian Affairs indicates in March 2017 ( just before the first malware samples associated with this campaign were identified in early April ) Hamas created “ a parallel institution to run local ministries in Gaza , ”


further straining the relationship between Hamas and the Palestinian Authority who governs the West Bank .


After this announcement , the Palestinian Authority cut salaries for its employees in Gaza by 30 percent and informed Israel that it would no longer pay for electricity provided to Gaza causing blackouts throughout the area and escalating tensions between the rival groups .


Then , in early May ( two days after the last malware sample was submitted ) the Palestinian Authority held local elections in the West Bank which were reportedly seen as a test for the Fatah party .


Elections were not held in Gaza .


All of that is to say , the decoy documents leveraged in this campaign would likely be relevant and of interest to a variety of targets in Israel and Palestine , consistent with previously identified KASPERAGENT targeting patterns .


Additionally , the use of what appear to be carefully crafted documents at the very least designed to look like official government correspondence suggests the malware may have been intended for a government employee or contractor who would be interested in the documents ’ subject matter .


APT28 : New Espionage Operations Target Military and Government Organizations .


Recent campaigns see APT28 group return to covert intelligence gathering operations in Europe and South America .


After making headlines during 2016 due to its involvement in cyber attacks against an organization involved in the U.S. presidential election , APT28 ( aka Swallowtail , Fancy Bear ) has continued to mount operations during 2017 and 2018 .


The espionage group , which according to the U.S. Department of Homeland Security ( DHS ) and the Federal Bureau of Investigation ( FBI ) is linked to the Russian government , returned to low-key intelligence-gathering operations during 2017 and into 2018 , targeting a range of military and government targets in Europe and South America .


APT28 has been active since at least January 2007 but received public attention in a major way during 2016 when it was implicated in a series of cyber attacks in the run up to the U.S. presidential election .


Beginning in the Spring of 2016 , APT28 sent spear-phishing emails to political targets including members of the Democratic National Committee ( DNC ) .


These emails were designed to trick recipients into supposedly changing their email passwords on a fake webmail domain .


The attack group then used these stolen credentials to gain access to the DNC network , install malware , move across the network , and steal data , including a trove of emails .


The compromised information was later leaked online .


These election attacks signaled a change of tactics on the part of APT28 , moving away from their prior low-key intelligence gathering towards more overt activity , seemingly intended to destabilize and disrupt victim organizations and countries .


The group was also responsible for the 2016 attack on the World Anti Doping Agency ( WADA ) and the leaking of confidential drug testing information .


In keeping with its shift to more overt tactics , the group appeared to publicly take credit for the attack , leaking the information on a website using the name “ Fancy Bears ” , an industry codename that was already widely used for the group .


After receiving an unprecedented amount of attention in 2016 , APT28 has continued to mount operations during 2017 and 2018 .


However , the group ’s activities since the beginning of 2017 have again become more covert and appear to be mainly motivated by intelligence gathering .


The organizations targeted by APT28 during 2017 and 2018 include :


A well-known international organization Military targets in Europe Governments in Europe A government of a South American country An embassy belonging to an Eastern European country .


APT28 uses a number of tools to compromise its targets .


The group ’s primary malware is Sofacy , which has two main components .


Trojan.Sofacy ( also known as Seduploader ) performs basic reconnaissance on an infected computer and can download further malware .


Backdoor.SofacyX ( also known as X-Agent ) is a second stage piece of malware , capable of stealing information from the infected computer .


A Mac version of the Trojan also exists ( OSX.Sofacy ) .


APT28 has continued to develop its tools over the past two years .


For example , Trojan.Shunnael ( aka X-Tunnel ) , malware used to maintain access to infected networks using an encrypted tunnel , underwent a rewrite to .NET .


In addition to this , as reported by our peers at ESET last week , the group has also begun using a UEFI ( Unified Extensible Firmware Interface ) rootkit known as Lojax .


Because the rootkit resides within a computer ’s flash memory , it allows the attackers to maintain a persistent presence on a compromised machine even if the hard drive is replaced or the operating system is reinstalled .


Symantec products block attempts to install Lojax with the detection name Trojan.Lojax .


Another attack group , Earworm ( aka Zebrocy ) , has been active since at least May 2016 and is involved in what appears to be intelligence gathering operations against military targets in Europe , Central Asia , and Eastern Asia .


The group uses spear-phishing emails to compromise its targets and infect them with malware .


Earworm uses two malware tools .


Trojan.Zekapab is a downloader component that is capable of carrying out basic reconnaissance functions and downloading additional malware to the infected computer .


Backdoor.Zekapab is installed on selected infected computers and is capable of taking screenshots , executing files and commands , uploading and downloading files , performing registry and file system operations , and carrying out system information tasks .


Earworm has also on occasion installed additional tools onto infected computers for the purposes of keylogging and password capture .


During 2016 , Symantec observed some overlap between the command and control ( C&C ) infrastructure used by Earworm and the C&C infrastructure used by Grizzly Steppe ( the U.S. government code name for APT28 and related actors ) , implying a potential connection between Earworm and APT28 .


However , Earworm also appears to conduct separate operations from APT28 and thus Symantec tracks them as a distinct group .


It is now clear that after being implicated in the U.S. presidential election attacks in late 2016 , APT28 was undeterred by the resulting publicity and continues to mount further attacks using its existing tools .


After its foray into overt and disruptive attacks in 2016 , the group has subsequently returned to its roots , mounting intelligence gathering operations against a range of targets .


This ongoing activity and the fact that APT28 continues to refine its toolset means that the group will likely continue to pose a significant threat to nation state targets .


Symantec has had the following protections in place to protect customers against APT28 attacks :


Trojan.Sofacy Backdoor.SofacyX Infostealer.Sofacy OSX.Sofacy Trojan.Shunnael Trojan.Lojax .


The following protections are in place to protect customers against Earworm attacks :


Trojan.Zekapab Backdoor.Zekapab .


A BREXIT-themed lure document that delivers ZEKAPAB malware .


SNAKEMACKEREL is an espionage-motivated cyber threat group , also known as Sofacy , Pawn Storm , Sednit , Fancy Bear , APT28 , Group 74 , Tsar Team , and Strontium .


Both the British and Dutch governments have publicly attributed SNAKEMACKEREL activities to the Russian military intelligence service ( RIS ) and have linked specific cyberattacks to the group , including the targeting of the Organisation for the Prohibition of Chemical Weapons ( OPCW ) , the United Kingdom Defence and Science Technology Laboratory ( DSTL ) and the United Kingdom Foreign and Commonwealth Office ( FCO ) .


According to the FBI , the SNAKEMACKEREL threat group "is part of an ongoing campaign of cyber-enabled operations directed at the United States government and its citizens .


These cyber operations have included spear phishing campaigns targeting government organizations , critical infrastructure entities , think tanks , universities , political organizations , and corporations , leading to the theft of information .


The creation of this malicious document , coming on the same day that the UK government announced an initial agreed draft of the BREXIT agreement , suggests that SNAKEMACKEREL is a group that pays close attention to political affairs and is able to leverage the latest news headlines to develop lure documents to deliver firststage malware , such as Zekapab , to its intended targets .


The theme also reflects the targeting of the group which primarily focuses on NATO members , countries in Central Asia and those neighboring Russia .


Despite the public reporting and government accusations , SNAKEMACKEREL remains highly active .


It is behind a large number of cyberattacks targeting global aerospace and defense contractors , military units , political parties , the International Olympic Committee ( IOC ) , anti-doping agencies , government departments and various other verticals .


NATO and EU member countries , as well as the United States , are of particular interest to the group .


SNAKEMACKEREL operations continue to be some of the most far-reaching and sophisticated cyber espionage and intelligence campaigns to date .


This report provides a technical overview of a BREXIT-themed lure Microsoft Office document that is used to drop a Delphi version of the Zekapab first-stage malware which has been previously reported by iDefense analysts .


However , additional research on the C2 server 109.248.148.42 revealed a new .NET version of Zekapab that is designed for the same purpose . iDefense analysts recently came across the following malicious document that is purportedly related to the recent BREXIT negotiations between the UK and the EU .


Brexit 15.11.2018.docx :


405655be03df45881aa88b55603bef1d .


Of note , the Company name Grizli777 is indicative of a cracked version of Microsoft Word .


To trick the targeted individual into enabling macros , the attackers deliberately used jumbled-up text as content .


The document loads malicious content from http://109.248.148.42/office/thememl/2012/main/attachedTemplate.dotm via the settings.xml.rels component that is embedded within the DOCX document .


The downloaded macro component includes a function called AutoClose() as well as two payloads embedded via Base64 encoded strings .


Research on the malicious IP address 109.248.148.42 revealed two different .dotm components :


Filename : attachedTemplate.dotm MD5 : 018611b879b2bbd886e86b62484494da Filename : templates.dotm MD5 : 2a794b55b839b3237482098957877326 .


The two components are dropped from the following URLs respectively :


http://109.248.148.42/office/thememl/2012/main/attachedTemplate.dotm http://109.248.148.42/officeDocument/2006/relationships/templates.dotm .


Both components contain an identical VBA macro code as shown above , each containing two different embedded payloads : one is an executable binary file and the other is a .docm file . attachedTemplate.dotm dropped the following :


Filename : ntslwin.exe MD5 : 7e67122d3a052e4755b02965e2e56a2e Filename : ~de03fc12a.docm MD5 : 9d703d31795bac83c4dd90527d149796 . templates.dotm dropped the following :


Filename : ntslwin.exe MD5 : a13c864980159cd9bdc94074b2389dda Filename : ~de03fc12a.docm MD5 : 9d703d31795bac83c4dd90527d149796 .


The second macro file ~de03fc12a.docm dropped includes a simple macro to execute the dropped executable .


Analysis into the two binaries shows that they are in fact a Delphi ( initially UPX packed ) and .NET version of the Zekapab first-stage malware .


The following network traffic is performed by the Delphi sample which has the following metadata once unpacked by UPX :


Filename : ntslwin.exe MD5 : f4cab3a393462a57639faa978a75d10a .


Exhibit 4 shows the network traffic generated by the sample , a http POST request containing the system information collected .


On the other hand , the network traffic generated by the .NET version is unencoded .


Both versions are designed to collect system information and running processes and send them to the designated C2 server using http POST to the URI used in both cases is /agr-enum/progress-inform/cube.php?res= .


If the system is deemed interesting , the next stage malware would be delivered into corresponding directories .


The second-stage malware is delivered to different destinations with an autorun registry key set respectively .


For the Delphi version , the following registry key and value are used for persistence :


Key : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AudioMgr Value : %AppData%\Video\videodrv.exe .


For the .NET version , the following registry key and value are used for persistence :


Key : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleIndexer Value : %AppData%\Platform\sslwin.exe .


The list of information collected includes :


Results from the commands systeminfo and tasklist Current execution path Capture screenshot Drive enumeration Drive serial number .


The code for downloading and executing the next stage malware .


As shown , the delivery of the next-stage malware is dependent on the information collected .


To mitigate the threat described in this report , iDefense recommends blocking access to the IP address and URI pattern :


109.248.148.42 /agr-enum/progress-inform/cube.php?res= .


For threat hunting , iDefense recommends searching for the following :


Network : Presence of http and DNS traffic to the network IOCs shared above .


System : Presence of the following artifacts .


Persistence mechanism Registry Key :


Key : HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AudioMgr Key : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleIndexer .


On disk artefacts File with the full path : %AppData%\Video\videodrv.exe File with the full path : %AppData%\Platform\sslwin.exe Files with following file hashes .


“ Cyber Conflict ” Decoy Document Used In Real Cyber Conflict .


Cisco Talos discovered a new malicious campaign from the well known actor Group 74 ( aka Tsar Team , Sofacy , APT28 , Fancy Bear ) .


Ironically the decoy document is a deceptive flyer relating to the Cyber Conflict U.S. conference .


CyCon US is a collaborative effort between the Army Cyber Institute at the United States Military Academy and the NATO Cooperative Cyber Military Academy and the NATO Cooperative Cyber Defence Centre of Excellence .


Due to the nature of this document , we assume that this campaign targets people with an interest in cyber security .


Unlike previous campaigns from this actor , the flyer does not contain an Office exploit or a 0-day , it simply contains a malicious Visual Basic for Applications ( VBA ) macro .


The VBA drops and executes a new variant of Seduploader .


This reconnaissance malware has been used by Group 74 for years and it is composed of 2 files : a dropper and a payload .


The dropper and the payload are quite similar to the previous versions but the author modified some public information such as MUTEX name , obfuscation .


We assume that these modifications were performed to avoid detection based on public IOCs .


The article describes the malicious document and the Seduploader reconnaissance malware , especially the difference with the previous versions .


The decoy document is a flyer concerning the Cyber Conflict U.S. conference with the following filename Conference_on_Cyber_Conflict.doc .


The Office document contains a VBA script .


The goal of this code is to get information from the properties of the document ( "Subject" , "Company" , "Category" , "Hyperlink base" and finally "Comments" ) .


Some of this information can be directly extracted from the Windows explorer by looking at the properties of the file .


The "Hyperlink Base" must be extracted using another tool , strings is capable of obtaining this by looking for long strings .


Pay close attention to the contents of these fields as they appear base64 encoded .


This extracted information is concatenated together to make a single variable .


This variable is decoded with the base64 algorithm in order to get a Windows library ( PE file ) which is written to disk .


The file is named netwf.dat .


On the next step this file is executed by rundll32.exe via the KlpSvc export .


We see that this file drops 2 additional files : netwf.bat and netwf.dll .


The final part of the VBA script changes the properties of these two files , setting their attributes to Hidden .


We can also see 2 VBA variable names : PathPld , probably for Path Payload , and PathPldBt , for Path Payload Batch .


As opposed to previous campaigns performed by this actor , this latest version does not contain privilege escalation and it simply executes the payload and configures persistence mechanisms .


The dropper installs 2 files :


netwf.bat :


executes netwf.dll netwf.dll :


the payload .


The dropper implements 2 persistence mechanisms :


HKCU\Environment\UserInitMprLogonScript to execute the netwf.bat file COM Object hijack of the following CLSID : {BCDE0395-E52F-467C-8E3D-C4579291692E} , the CLSID of the class MMDeviceEnumerator .


These 2 techniques have also been previously used by this actor .


Finally the payload is executed by rundll32.exe ( and the ordinal #1 in argument ) or by explorer.exe if the COM Object hijack is performed .


In this case , explorer.exe will instance the MMDeviceEnumerator class and will execute the payload .


The payload features are similar to the previous versions of Seduploader .


We can compare it to the sample e338d49c270baf64363879e5eecb8fa6bdde8ad9 used in May 2017 by Group 74 .


Of the 195 functions of the new sample , 149 are strictly identical , 16 match at 90% and 2 match at 80% .


In the previous campaign where adversaries used Office document exploits as an infection vector , the payload was executed in the Office word process .


In this campaign , adversaries did not use any exploit .


Instead ,the payload is executed in standalone mode by rundll32.exe .


Adversaries also changed some constants , such as the XOR key used in the previous version .


The key in our version is : key=b"\x08\x7A\x05\x04\x60\x7c\x3e\x3c\x5d\x0b\x18\x3c\x55\x64" .


The MUTEX name is different too : FG00nxojVs4gLBnwKc7HhmdK0h .


Here are some of the Seduploader features :


Screenshot capture ( with the GDI API ) ;


data/configuration Exfiltration ;


Execution of code ;


File downloading ;


The Command & Control ( CC ) of the analysed sample is myinvestgroup[.]com .


During the investigation , the server did not provide any configuration to the infected machines .


Based on the metadata of the Office documents and the PE files , the attackers had created the file on Wednesday , the 4th of October .


Analysis of this campaign shows us once more that attackers are creative and use the news to compromise the targets .


This campaign has most likely been created to allow the targeting of people linked to or interested by cybersecurity , so probably the people who are more sensitive to cybersecurity threats .


In this case , Group 74 did not use an exploit or any 0-day but simply used scripting language embedded within the Microsoft Office document .


Due to this change , the fundamental compromise mechanism is different as the payload is executed in a standalone mode .


The reasons for this are unknown , but , we could suggest that they did not want to utilize any exploits to ensure they remained viable for any other operations .


Actors will often not use exploits due to the fact that researchers can find and eventually patch these which renders the actors weaponized platforms defunct .


Additionally the author did some small updates after publications from the security community , again this is common for actors of this sophisticated nature , once their campaigns have been exposed they will often try to change tooling to ensure better avoidance .


For example the actor changed the XOR key and the MUTEX name .


APT28 : AT THE CENTER OF THE STORM .


The Democratic National Committee ’s ( DNC ) June 2016 announcement attributing its network breach to the Russian Government triggered an international debate over Russia ’s sponsorship of information operations against the U.S.


Our visibility into the operations of APT28 - a group we believe the Russian Government sponsors - has given us insight into some of the government ’s targets , as well as its objectives and the activities designed to further them .


We have tracked and profiled this group through multiple investigations , endpoint and network detections , and continuous monitoring .


Our visibility into APT28 ’s operations , which date to at least 2007 , has allowed us to understand the group ’s malware , operational changes , and motivations .


This intelligence has been critical to protecting and informing our clients , exposing this threat , and strengthening our confidence in attributing APT28 to the Russian Government .


On December 29 , 2016 , the Department of Homeland Security ( DHS ) and Federal Bureau of Investigation ( FBI ) released a Joint Analysis Report confirming FireEye ’s long held public assessment that the Russian Government sponsors APT28 .


Since at least 2007 , APT28 has engaged in extensive operations in support of Russian strategic interests .


The group , almost certainly compromised of a sophisticated and prolific set of developers and operators , has historically collected intelligence on defense and geopolitical issues .


APT28 espionage activity has primarily targeted entities in the U.S. , Europe , and the countries of the former Soviet Union , including governments and militaries , defense attaches , media entities , and dissidents and figures opposed to the current Russian Government .


Over the past two years , Russia appears to have increasingly leveraged APT28 to conduct information operations commensurate with broader strategic military doctrine .


After compromising a victim organization , APT28 will steal internal data that is then leaked to further political narratives aligned with Russian interests .


To date these have included the conflict in Syria , NATO-Ukraine relations , the European Union refugee and migrant crisis , the 2016 Olympics and Paralympics Russian athlete doping scandal , public accusations regarding Russian state-sponsored hacking , and the 2016 U.S. presidential election .


This report details our observations of APT28 ’s targeting , and our investigation into a related breach .


We also provide an update on shifts in the group ’s tool development and use , and summarize the tactics APT28 employs to compromise its victims .


In October 2014 , FireEye released APT28 : A Window into Russia ’s Cyber Espionage Operations? , and characterized APT28 ’s activity as aligning with the Russian Government ’s strategic intelligence requirements .


While tracking APT28 , we noted the group ’s interest in foreign governments and militaries , particularly those of European and Eastern European nations , as well as regional security organizations , such as the North Atlantic Treaty Organization ( NATO ) and the Organization for Security and Cooperation in Europe ( OSCE ) , among others .


Table 1 highlights some recent examples of this activity .


OSCE :


NOVEMBER 2016 , The OSCE confirmed that it had suffered an intrusion , which a Western intelligence service attributed to APT28 .


Germany 's Christian Democratic Union ( CDU ) :


APRIL - MAY 2016 , Researchers at Trend Micro observed APT28 establish a fake CDU email server and launch phishing emails against CDU members in an attempt to obtain their email credentials and access their accounts .


Pussy Riot AUGUST :


2015 , APT28 targets Russian rockers and dissidents Pussy Riot via spear-phishing emails .


NATO , Afghan Ministry of Foreign Affairs , Pakistani Military :


JULY 2015 , APT28 used two domains ( nato-news.com and bbc-news.org ) to host an Adobe Flash zero-day exploit to target NATO , the Afghan Ministry of Foreign Affairs , and the Pakistani military .


German Bundestag & Political Parties :


JUNE 2015 , Germany ’s Federal Office for Security in Information Technology ( BSI ) announced that APT28 was likely responsible for the spear phishing emails sent to members of several German political parties .


The head of Germany ’s domestic intelligence agency , Bundesamt für Verfassungsschutz ( BfV ) , also attributed the June 2015 compromise of the Bundestag ’s networks to APT28 .


Kyrgyzstan Ministry of Foreign Affairs :


OCTOBER 2014 THROUGH SEPTEMBER 2015 , FireEye iSight Intelligence identified changes made to domain name server ( DNS ) records that suggest that APT28 intercepted email traffic from the Kyrgyzstan Ministry of Foreign Affairs after maliciously modifying DNS records of the ministry ’s authoritative DNS servers .


Polish Government & Power Exchange websites :


JUNE AND SEPTEMBER 2014 , APT28 employed “ Sedkit ” in conjunction with strategic web compromises to deliver “ Sofacy ” malware on Polish Government websites , and the websites of Polish energy company Power Exchange .


On September 13 , WADA confirmed that APT28 had compromised its networks and accessed athlete medical data .


On September 12 , 2016 , the “ Fancy Bears ’ Hack Team ” persona claimed to have compromised WADA and released athletes ’ medical records as “ proof of American athletes taking doping. ”


The DNC announced it had suffered a network compromise and that a subsequent investigation found evidence of two breaches , attributed to APT28 and APT29 .


FireEye analyzed the malware found on DNC networks and determined that it was consistent with our previous observations of APT28 tools .


In June 2016 , shortly after the DNC ’s announcement , the Guccifer 2.0 persona claimed responsibility for the DNC breach and leaked documents taken from the organization ’s network .


Guccifer 2.0 continued to leak batches of DNC documents through September .


Investigators found that John Podesta , Hillary Clinton ’s presidential campaign chairman , was one of thousands of individuals targeted in a mass phishing scheme using shortened URLs that security researchers attributed to APT28 .


Throughout October and into early November , WikiLeaks published 34 batches of email correspondence stolen from John Podesta ’s personal email account .


Correspondence of other individuals targeted in the same phishing campaign , including former Secretary of State Colin Powell and Clinton campaign staffer William Rinehart , were published on the “ DC Leaks ” website .


In July , the DCCC announced that it was investigating an ongoing “ cybersecurity incident ” that the FBI believed was linked to the compromise of the DNC .


House Speaker Nancy Pelosi later confirmed that the DCCC had suffered a network compromise .


Investigators indicated that the actors may have gained access to DCCC systems as early as March .


In August , the Guccifer 2.0 persona contacted reporters covering U.S. House of Representative races to announce newly leaked documents from the DCCC pertaining to Democratic candidates .


From August to October , Guccifer 2.0 posted several additional installments of what appear to be internal DCCC documents on “ his ” WordPress site .


In February , FireEye identified CORESHELL traffic beaconing from TV5Monde ’s network , confirming that APT28 had compromised TV5Monde ’s network .


In April 2015 , alleged pro-ISIS hacktivist group CyberCaliphate defaced TV5Monde ’s websites and social media profiles and forced the company ’s 11 broadcast channels offline .


FireEye identified overlaps between the domain registration details of CyberCaliphate ’s website and APT28 infrastructure .


Ukrainian officials revealed that the investigation into the compromise of the CEC ’s internal network identified malware traced to APT28 .


During the May 2014 Ukrainian presidential election , purported pro-Russian hacktivists CyberBerkut conducted a series of malicious activities against the CEC including a system compromise , data destruction , a data leak , a distributed denial-of-service ( DDoS ) attack , and an attempted defacement of the CEC website with fake election results .


As news of the DNC breach spread , APT28 was preparing for another set of operations : countering the condemnation that Russia was facing after doping allegations and a threatened blanket ban of the Russian team from the upcoming Rio Games .


Russia , like many nations , has long viewed success in the Olympic Games as a source of national prestige and soft power on the world stage .


The doping allegations and prospective ban from the Games further ostracized Russia , and likely provided motivation to actively counter the allegations by attempting to discredit anti-doping agencies and policies .


Our investigation of APT28 ’s compromise of WADA ’s network , and our observations of the surrounding events reveal how Russia sought to counteract a damaging narrative and delegitimize the institutions leveling criticism .


Since releasing our 2014 report , we continue to assess that APT28 is sponsored by the Russian Government .


We further assess that APT28 is the group responsible for the network compromises of WADA and the DNC and other entities related to the 2016 U.S. presidential election cycle .


These breaches involved the theft of internal data - mostly emails – that was later strategically leaked through multiple forums and propagated in a calculated manner almost certainly intended to advance particular Russian Government aims .


In a report released on January 7 2017 , the U.S. Directorate of National Intelligence described this activity as an “ influence campaign. ” This influence campaign - a combination of network compromises and subsequent data leaks - aligns closely with the Russian military ’s publicly stated intentions and capabilities .


Influence operations , also frequently called “ information operations , ” have a long history of inclusion in Russian strategic doctrine , and have been intentionally developed , deployed , and modernized with the advent of the internet .


The recent activity in the U.S. is but one of many instances of Russian Government influence operations conducted in support of strategic political objectives , and it will not be the last .


As the 2017 elections in Europe approach - most notably in Germany , France , and the Netherlands - we are already seeing the makings of similarly concerted efforts .


In our 2014 report , we identified APT28 as a suspected Russian government-sponsored espionage actor .


We came to this conclusion in part based on forensic details left in the malware that APT28 had employed since at least 2007 .


We have provided an updated version of those conclusions , a layout of the tactics that they generally employ , as well as observations of apparent tactical shifts .


For full details , please reference our 2014 report , APT28 : A Window into Russia ’s Cyber Espionage Operations ? APT28 employs a suite of malware with features indicative of the group ’s plans for continued operations , as well as the group ’s access to resources and skilled developers .


CHOPSTICK :


backdoor , Xagent , webhp , SPLM .


EVILTOSS :


backdoor , Sedreco , AZZY , Xagent , ADVSTORESHELL , NETUI .


GAMEFISH :


backdoor , Sednit , Seduploader , JHUHUGIT , Sofacy .


SOURFACE :


downloader , Older version of CORESHELL , Sofacy .


OLDBAIT :


credential harvester , Sasfis .


CORESHELL :


downloader , Newer version of SOURFACE , Sofacy .


APT28 continues to evolve its toolkit and refine its tactics in what is almost certainly an effort to protect its operational effectiveness in the face of heightened public exposure and scrutiny .


In addition to the continued evolution of the group ’s first stage tools , we have also noted APT28 : Leveraging zero-day vulnerabilities in Adobe Flash Player , Java , and Windows , including CVE-2015-1701 , CVE-2015-2424 , CVE-2015-2590 , CVE-2015-3043 , CVE-2015-5119 , and CVE-2015-7645 .


Using a profiling script to deploy zero-days and other tools more selectively , decreasing the chance that researchers and others will gain access to the group ’s tools .


Increasing reliance on public code depositories , such as Carberp , PowerShell Empire , P.A.S. webshell , Metasploit modules , and others in a likely effort to accelerate their development cycle and provide plausible deniability .


Obtaining credentials through fabricated Google App authorization and Oauth access requests that allow the group to bypass two-factor authentication and other security measures .


Moving laterally through a network relying only on legitimate tools that already exist within the victims ’ systems , at times forgoing their traditional toolset for the duration of the compromise .


Threat Group 4127 Targets Hillary Clinton Presidential Campaign .


The Hillary Clinton email leak was the center of the latest scandal in the news caused by Threat Group-4127 ( TG-4127 ) .


SecureWorks Counter Threat Unit ( CTU ) researchers track the activities of Threat Group-4127 , which targets governments , military , and international non-governmental organizations ( NGOs ) .


Components of TG-4127 operations have been reported under the names APT28 , Sofacy , Sednit , and Pawn Storm .


CTU researchers assess with moderate confidence that the group is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government .


Between October 2015 and May 2016 , CTU researchers analyzed 8,909 Bitly links that targeted 3,907 individual Gmail accounts and corporate and organizational email accounts that use Gmail as a service .


In March 2016 , CTU researchers identified a spearphishing campaign using Bitly accounts to shorten malicious URLs .


The targets were similar to a 2015 TG-4127 campaign — individuals in Russia and the former Soviet states , current and former military and government personnel in the U.S. and Europe , individuals working in the defense and government supply chain , and authors and journalists — but also included email accounts linked to the November 2016 United States presidential election .


Specific targets include staff working for or associated with Hillary Clinton's presidential campaign and the Democratic National Committee ( DNC ) , including individuals managing Clinton's communications , travel , campaign finances , and advising her on policy .


The short links in the spearphishing emails redirected victims to a TG-4127 controlled URL that spoofed a legitimate Google domain .


A Base64 encoded string containing the victim's full email address is passed with this URL , prepopulating a fake Google login page displayed to the victim .


If a victim enters their credentials , TG-4127 can establish a session with Google and access the victim's account .


The threat actors may be able to keep this session alive and maintain persistent access .


The Hillary for America presidential campaign owns the hillaryclinton.com domain , which is used for the campaign website ( www.hillaryclinton.com ) and for email addresses used by campaign staff .


An examination of the hillaryclinton.com DNS records shows that the domain's MX records , which indicate the mail server used by the domain , point to aspmx.l.google.com , the mail server used by Google Apps .


Google Apps allows organizations to use Gmail as their organizational mail solution .


TG-4127 exploited the Hillary for America campaign's use of Gmail and leveraged campaign employees' expectation of the standard Gmail login page to access their email account .


When presented with TG-4127 's spoofed login page , victims might be convinced it was the legitimate login page for their hillaryclinton.com email account .


CTU researchers observed the first short links targeting hillaryclinton.com email addresses being created in mid-March 2016 ; the last link was created in mid-May .


During this period , TG-4127 created 213 short links targeting 108 email addresses on the hillaryclinton.com domain .


Through open-source research , CTU researchers identified the owners of 66 of the targeted email addresses .


There was no open-source footprint for the remaining 42 addresses , suggesting that TG-4127 acquired them from another source , possibly other intelligence activity .


The identified email owners held a wide range of responsibilities within the Hillary for America campaign , extending from senior figures to junior employees and the group mailboxes for various regional offices .


Targeted senior figures managed communications and media affairs , policy , speech writing , finance , and travel , while junior figures arranged schedules and travel for Hillary Clinton's campaign trail .


Targets held the following titles :


National political director Finance director Director of strategic communications Director of scheduling Director of travel Traveling press secretary Travel coordinator .


Publicly available Bitly data reveals how many of the short links were clicked , likely by a victim opening a spearphishing email and clicking the link to the fake Gmail login page .


Only 20 of the 213 short links have been clicked as of this publication .


Eleven of the links were clicked once , four were clicked twice , two were clicked three times , and two were clicked four times .


The U.S. Democratic party's governing body , the Democratic National Committee ( DNC ) , uses the dnc.org domain for its staff email .


Between mid-March and mid-April 2016 , TG-4127 created 16 short links targeting nine dnc.org email accounts .


CTU researchers identified the owners of three of these accounts ; two belonged to the DNC 's secretary emeritus , and one belonged to the communications director .


Four of the 16 short links were clicked , three by the senior staff members .


As of this publication , dnc.org does not use the Google Apps Gmail email service .


However , because dnc.org email accounts were targeted in the same way as hillaryclinton.com accounts , it is likely that dnc.org did use Gmail at that time and later moved to a different service .


CTU researchers do not have evidence that these spearphishing emails are connected to the DNC network compromise that was revealed on June 14 .


However , a coincidence seems unlikely , and CTU researchers suspect that TG-4127 used the spearphishing emails or similar techniques to gain an initial foothold in the DNC network .


CTU researchers identified TG-4127 targeting 26 personal gmail.com accounts belonging to individuals linked to the Hillary for America campaign , the DNC , or other aspects of U.S. national politics .


Five of the individuals also had a hillaryclinton.com email account that was targeted by TG-4127 .


Many of these individuals held communications , media , finance , or policy roles .


They include the director of speechwriting for Hillary for America and the deputy director office of the chair at the DNC .


TG-4127 created 150 short links targeting this group .


As of this publication , 40 of the links have been clicked at least once .


Although the 2015 campaign did not focus on individuals associated with U.S. politics , open-source evidence suggests that TG-4127 targeted individuals connected to the U.S. White House in early 2015 .


The threat group also reportedly targeted the German parliament and German Chancellor Angela Merkel's Christian Democratic Union party .


CTU researchers have not observed TG-4127 use this technique ( using Bitly short links ) to target the U.S. Republican party or the other U.S. presidential candidates whose campaigns were active between mid-March and mid-May : Donald Trump , Bernie Sanders , Ted Cruz , Marco Rubio , and John Kasich .


However , the following email domains do not use Google mail servers and may have been targeted by other means :


gop.com — used by the Republican National Committee , donaldjtrump.com — used by the Donald Trump campaign , johnkasich.com — used by the John Kasich campaign .


Access to targets' Google accounts allows TG-4127 to review internal emails and potentially access other Google Apps services used by these organizations , such as Google Drive .


In addition to the value of the intelligence , the threat actors could also exploit this access for other malicious activity , such as generating spearphishing emails from internal email addresses to compromise the organizations' networks with malware .


The Russian government views the U.S. as a strategic rival and is known to task its intelligence agencies with gathering confidential information about individuals and organizations close to the center of power in the U.S. Individuals working for the Hillary for America campaign could have information about proposed policies for a Clinton presidency , including foreign-policy positions , which would be valuable to the Russian government .


Information about travel plans and campaign scheduling could provide short-term opportunities for other intelligence operations .


Long-term access to email accounts of senior campaign advisors , who may be appointed to staff positions in a Clinton administration , could provide TG-4127 and the Russian government with access to those individual's accounts .


While TG-4127 continues to primarily threaten organizations and individuals operating in Russia and former Soviet states , this campaign illustrates its willingness to expand its scope to other targets that have intelligence of interest to the Russian government .


Non-governmental political organizations may provide access to desirable national policy information , especially foreign policy , but may not have the same level of protection and security as governmental organizations .


Targeting individuals linked to presidential campaigns could represent an intelligence ‘ long game ,' as establishing access to potential U.S. administration staff before they are appointed could be easier than targeting them when they are established in the White House .


Access to an individual's personal or corporate email account provides a substantial amount of useful intelligence , and threat actors could also leverage the access to launch additional attacks to penetrate the network of an associated organization .


Users rarely check the full URL associated with short links , so threat groups can use URL-shortening services to effectively hide malicious URLs .


Threat actors can use the services' detailed statistics about which links were clicked when , and from what location , to track the success of a spearphishing campaign .


A single compromised account could allow TG-4127 to achieve its operational goals .


CTU researchers recommend that clients take appropriate precautions to minimize the risk of these types of attacks :


Educate users about the risks of spearphishing emails .


Use caution and exercise due diligence when faced with a shortened link , especially in unsolicited email messages .


Pasting Bitly URLs , appended with a plus sign , into the address bar of a web browser reveals the full URL .


Sofacy APT hits high profile targets with updated toolset .


Sofacy ( also known as “ Fancy Bear ” , “ Sednit ” , “ STRONTIUM ” and “ APT28 ” ) is an advanced threat group that has been active since around 2008 , targeting mostly military and government entities worldwide , with a focus on NATO countries .


More recently , we have also seen an increase in activity targeting Ukraine .


Back in 2011-2012 , the group used a relatively tiny implant ( known as “ Sofacy ” or SOURFACE ) as its first stage malware .


The implant shared certain similarities with the old Miniduke implants .


This led us to believe the two groups were connected , at least to begin with , although it appears they parted ways in 2014 , with the original Miniduke group switching to the CosmicDuke implant .


At some point during 2013 , the Sofacy group expanded its arsenal and added more backdoors and tools , including CORESHELL , SPLM ( aka Xagent , aka CHOPSTICK ) , JHUHUGIT ( which is built with code from the Carberp sources ) , AZZY ( aka ADVSTORESHELL , NETUI , EVILTOSS , and spans across four to five generations ) and a few others .


We ’ve seen quite a few versions of these implants and they were relatively widespread for a time .


Sofacy ’s August 2015 attack wave .


In the months leading up to August , the Sofacy group launched several waves of attacks relying on zero-day exploits in Microsoft Office , Oracle Sun Java , Adobe Flash Player and Windows itself .


For instance , its JHUHUGIT implant was delivered through a Flash zero-day and used a Windows EoP exploit to break out of the sandbox .


The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day ( CVE-2015-2590 ) in July 2015 .


While the JHUHUGIT ( and more recently , “ JKEYSKW ” ) implant used in most of the Sofacy attacks , high profile victims are being targeted with another first level implant , representing the latest evolution of their AZZYTrojan .


The first versions of the new AZZY implant appeared in August of this year .


During a high profile incident we investigated , our products successfully detected and blocked a “ standard ” Sofacy “ AZZY ” sample that was used to target a range of defense contractors .


The sample used in this attack ( MD5 A96F4B8AC7AA9DBF4624424B7602D4F7 , compiled July 29th , 2015 ) was a pretty standard Sofacy x64 AZZY implant , which has the internal name “ advshellstore.dll ” .


Interestingly , the fact that the attack was blocked didn’t appear to stop the Sofacy team .


Just an hour and a half later they had compiled and delivered another AZZY x64 backdoor ( md5: 9D2F9E19DB8C20DC0D20D50869C7A373 , compiled August 4th , 2015 ) .


This was no longer detectable with static signatures by our product .


However , it was detected dynamically by the host intrusion prevention subsystem when it appeared in the system and was executed .


This recurring , blindingly-fast Sofacy attack attracted our attention as neither sample was delivered through a zero-day vulnerability — instead , they appeared to be downloaded and installed by another malware .


This separate malware was installed by an unknown attack as “ AppData\Local\Microsoft\Windows\msdeltemp.dll ” ( md5: CE8B99DF8642C065B6AF43FDE1F786A3 ) .


The top level malware , CE8B99DF8642C065B6AF43FDE1F786A3 ( named by its authors “ msdeltemp.dll ” according to internal strings , and compiled July 28th , 2015 ) is a rare type of the Sofacy AZZY implant .


It has been modified to drop a separate C&C helper , ( md5: 8C4D896957C36EC4ABEB07B2802268B9 ) as “ tf394kv.dll “ .


The dropped “ tf394kv.dll ” file is an external C&C communications library , compiled on July 24th , 2015 and used by the main backdoor for all Internet-based communications .


This code modification marks an unusual departure from the typical AZZY backdoors , with its C&C communication functions moved to an external DLL file .


In the past , the Sofacy developers modified earlier AZZY backdoors to use a C&C server encoded in the registry , instead of storing it in the malware itself , so this code modularisation follows the same line of thinking .


In addition to the new AZZY backdoors with side-DLL for C&C , we observed a new set of data-theft modules deployed against victims by the Sofacy group .


Among the most popular modern defense mechanisms against APTs are air-gaps — isolated network segments without Internet access , where sensitive data is stored .


In the past , we ’ve seen groups such as Equation and Flame use malware to steal data from air-gapped networks .


The Sofacy group uses such tools as well .


The first versions of these new USB stealer modules appeared around February 2015 and the latest appear to have been compiled in May 2015 .


Older versions of these USBSTEALER modules were previously described by our colleagues from ESET .


One example of the new Sofacy USBSTEALER modules is 8b238931a7f64fddcad3057a96855f6c , which is named internally as msdetltemp.dll .


This data theft module appears to have been compiled in May 2015 and is designed to watch removable drives and collect files from them , depending on a set of rules defined by the attackers .


The stolen data is copied into a hidden directory as “ %MYPICTURES%\%volume serial number% “ , from where it can be exfiltrated by the attackers using one of the AZZY implants .


More details on the new USB stealers are available in the section on technical analysis .


Over the last year , the Sofacy group has increased its activity almost tenfold when compared to previous years , becoming one of the most prolific , agile and dynamic threat actors in the arena .


This activity spiked in July 2015 , when the group dropped two completely new exploits , an Office and Java zero-day .


At the beginning of August , Sofacy began a new wave of attacks , focusing on defense-related targets .


As of November 2015 , this wave of attacks is ongoing .


The attackers deploy a rare modification of the AZZY backdoor , which is used for the initial reconnaissance .


Once a foothold is established , they try to upload more backdoors , USB stealers as well as other hacking tools such as “ Mimikatz ” for lateral movement .


Two recurring characteristics of the Sofacy group that we keep seeing in its attacks are speed and the use of multi-backdoor packages for extreme resilience .


In the past , the group used droppers that installed both the SPLM and AZZY backdoors on the same machine .


If one of them was detected , the other one provided the attacker with continued access .


Internal name : DWN_DLL_MAIN.dll File format : PE32 DLL MD5: ce8b99df8642c065b6af43fde1f786a3 Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.07.28 13:05:20 ( GMT ) .


The library starts its main worker thread from the DllMain function .


Most of the strings inside the module are encrypted with a homebrew XOR-based algorithm .


In addition to that , API function names are reversed , presumably to avoid detection in memory .


Once started , the code in the main thread resolves the basic API functions it needs and loads an additional library from the following location : “ %TEMP%\tf394kv.dll ” .


If this file is not present , it is recreated from a hardcoded encrypted array inside the body of the DLL .


Next , the module enters an infinite loop .


Every five minutes it collects basic system information and sends it to the C2 server .


The main thread also spawns a separate thread for receiving new commands from the C2 servers .


Every 10 minutes , it sends a new request to the server .


The server is expected to send back executable code and one of the following commands :


Write a new file “ %LOCAL_APPDATA%\dllhost.exe ” or “ %TEMP%\dllhost.exe ” and execute it , then delete the file , Write a new file “ %LOCAL_APPDATA%\sechost.dll ” or “ %TEMP%\sechost.dll ” and call its first exported function using “ rundll32.exe ” or Windows API , then delete the file , Run shellcode provided by the server in a new thread While processing the commands , the backdoor logs all errors and execution results .


The module also reads the contents of the file “ %APPDATA%\chkdbg.log ” and appends it to the results .


It then sends the aggregated log back to the C2 server .


The module aborts the thread receiving C2 command after it fails to correctly execute commands more than six times in a row , i.e. if file or process creation fails .


The export called “ k ” is a wrapper for the “ LoadLibraryA ” API function .


The export called “ SendDataToServer_2 ” does exactly what the name means : it encrypts all collected data , encodes it using Base64 encoding and calls its additional library to send the data to the C2 server .


The names of the C2 servers are hardcoded .


The two C&C ’s hardcoded in the configuration block of the main binary are :


intelnetservice.com intelsupport.net The export called “ Applicate ” runs a standard Windows application message loop until a “ WM_ENDSESSION ” message is received .


It then terminates the main thread .


Internal name : snd.dll File format : PE32 DLL MD5: 8c4d896957c36ec4abeb07b2802268b9 Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.07.24 12:07:27 ( GMT ) Exported functions :


10001580: Init 10001620: InternetExchange 10001650: SendData This external library implements a simple Wininet-based transport for the main module .


The strings inside the binary are encrypted using 3DES and XOR and reversed .


The DllMain function initializes the library and resolves all required Windows API functions .


The “ Init ” export establishes connection to port 80 of a C2 server using Wininet API .


The user agent string employed is “ MSIE 8.0 ” .


The “ SendData ” export sends a HTTP POST request using a hardcoded URI “ /store/ “ .


The reply , if its length is not equal to six and its contents do not contain “ OK ” is returned back to the caller .


The “ InternetExchange ” export closes the established connection and frees associated handles .


Sofacy AZZY 4.3 dropper analysis File format : PE32 EXE File size : 142,336 bytes MD5: c3ae4a37094ecfe95c2badecf40bf5bb Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.02.10 10:01:59 ( GMT ) Most of the strings and data in the file are encrypted using 3DES and XOR .


The code makes use of the Windows Crypto API for 3DES and the decryption key is stored as a standard Windows PUBLICKEYSTRUC structure .


First , it creates a new directory : “ %LOCAL_APPDATA%\Microsoft\Windows ” .


If the directory creation fails it tries to install into “ %TEMP% ” directory instead .


Next it writes a hardcoded binary from its body to “ msdeltemp.dll ” into the target directory .


If the file exists it then moves it to “ __tmpdt.tmp ” in the same directory and continues the installation .


Sets file creation timestamp to that of “ %SYSTEM%\sfc.dll ” .


Finally , the program removes itself by starting the following command : “ cmd /c DEL %path to self% “ The MD5 of the dropped file is f6f88caf49a3e32174387cacfa144a89 .


Dropper payload – downloader DLL Internal name : msdetltemp.dll File format : PE32 DLL File size : 73 728 bytes MD5: f6f88caf49a3e32174387cacfa144a89 Linker version : 11.0 , Microsoft Visual Studio Linker timestamp : 2015.02.10 07:20:02 ( GMT ) Exported functions :


10002B55: Applicate Most of the strings inside the binary are encrypted using a homebrew XOR-based algorithm and reversed .


The library is an older version of the “ DWN_DLL_MAIN.dll ” ( md5: ce8b99df8642c065b6af43fde1f786a3 ) .


The DllMain function is identical and starts the main thread ; the “ Applicate ” function is identical to the one in the newer library .


This version of the module does not rely on an external transport DLL for communicating with its C2 servers ; instead it directly uses Wininet API functions .


The module contains the following hardcoded C2 server names :


drivres-update.info softupdates.info The module uses a hardcoded URL ( “ /check/ “ ) for sending HTTP POST requests to its C2 servers .


Sofacy APT hits high profile targets with updated toolset .


File collection module ( “ USB Stealer ” ) Internal name : msdetltemp.dll ( from resources ) File size : 50,176 bytes File format : PE32 EXE MD5: 0369620eb139c3875a62e36bb7abdae8 Linker version : 10.0 , Microsoft Visual Studio Linker timestamp : 2015.02.09 11:48:01 ( GMT ) Most of the strings inside the binary are encrypted using 3DES and XOR and reversed .


The program creates the mutex “ mtx ” and an event named “ WerTyQ34C ” .


Upon start , it creates a window with the class name “ Hello ” and title “ Program ” , subscribes for device arrival notifications for that window and enters a standard Windows message processing loop .


The message processing function waits for the WM_DEVICECHANGE event and starts a new thread on its arrival .


The module inspects every new disk volume attached to the system .


For every disk it creates a “ stash ” directory in “ %root stash directory location%\%volume serial number in hex% ” with attributes FILE_ATTRIBUTE_HIDDEN and FILE_ATTRIBUTE_SYSTEM .


The root stash directory location may be read from the configuration file or set to the default location which is “ %MYPICTURES% ” .


Then , it traverses the filesystem of the volume looking for files .


Depending on the settings read from the configuration file , the scope may be narrowed to files with particular extensions and/or files created after a specified date .


It is worth noting that if the source file location contains the string “ System Volume Information\S-1-5-21-1315235578-283289242\ ” , then the file is deleted after copying to the “ stash ” directory .


There are known related samples that are able to create such directories on removable drives , i.e . the sample with md5: 8cb08140ddb00ac373d29d37657a03cc .


The configuration file is loaded from the same directory as the module and is expected to have a name “ NvCpld.dat “ .


It is a text file that may contain the following configuration parameters :


Path – location of the root “ stash ” directory Ext – search for files with one of these extensions only Date – search for files not earlier than this date Internal name : NvCpld.dll ( from export table ) , msdetltemp.dll ( from resources ) , IGFSRVC.dll ( from resources ) File format : PE32 DLL File size : 76,288 bytes MD5s : 8b238931a7f64fddcad3057a96855f6c , ce151285e8f0e7b2b90162ba171a4b90 Linker version : 11.0 , Microsoft Visual Studio Linker timestamps : 2015.05.29 11:20:32 ( GMT ) , 2006.11.25 04:39:15 ( GMT ) Exported functions :


10002500: NvMswt 10002860: NvReg 10002880: NvStart 10002A80: NvStop This library is a newer version of the file collection module ( md5: 0369620eb139c3875a62e36bb7abdae8 ) wrapped in a DLL file .


There are two known variants of this module ; they only differ in timestamp values and version information in the resource section .


The DllMain function only decrypts the data structures and initializes Windows API pointers .


The function “ NvMswt ” is a wrapper for the API function MsgWaitForMultipleObjects .


The function “ NvReg ” is a wrapper for the API function RegisterClassW .


The function “ NvStart ” is similar to the main function of the older module ; it creates a window and enters the message loop waiting for device arrival notifications .


The only difference introduced is that an event named “ WerTyQ34C ” can be signalled by the function “ NvStop ” to terminate the message loop and stop processing .


How they did it : GRU hackers .


US elections .


In a press briefing just two weeks ago , Deputy Attorney General Rod Rosenstein announced that the grand jury assembled by Special Counsel Robert Mueller had returned an indictment against 12 officers of Russia 's Main Intelligence Directorate of the Russian General Staff ( better known as Glavnoye razvedyvatel'noye upravleniye , or GRU ) .


The indictment was for conducting " active cyber operations with the intent of interfering in the 2016 presidential election . " The espionage operation was run by Unit 26165 , commanded by GRU Officer Viktor Borisovich Netykshko .


Unit 26165 appears to be the organization behind at least part of the "threat group" of tools , techniques , and procedures known as " Fancy Bear , " " Sofacy , " " APT28 , " and " Sednit " .


Within the unit , two divisions were involved in the breaches : one specializing in operations and the second in development and maintenance of hacking tools and infrastructure .


The operations division , supervised by Major Boris Alekseyevich Antonov , specialized in targeting organizations of intelligence interest through spear-phishing campaigns and the exploitation of stolen credentials .


Antonov's group included Ivan Sergeyevich Yermakov and Senior Lieutenant Aleksey Viktorovich Lukashev , according to the indictment , and they were responsible for targeting the email accounts that were exposed on the " DCLeaks " site prior to the election operations .


The second division , overseen by Lieutenant Colonel Sergey Aleksandrovich Morgachev , managed the development and maintenance of malware and hacking tools used by Unit 26165 , including the X-Agent " implant " .


X-Agent is a signature tool of Fancy Bear operations—a cross-platform backdoor toolset with variants for Windows , MacOS , Android , and iOS .


The Windows and MacOS versions of X-Agent are capable of recording keystrokes , taking screenshots , and exfiltrating files from infected systems back to a command and control server .


Lieutenant Captain Nikolay Kozacheck ( who used the hacker monikers " kazak " and " blablabla1234465 " ) was the primary developer and maintainer of X-Agent , according to the indictment , and he was assisted by another officer , Pavel Yershov , in preparing it for deployment .


Once X-Agent was implanted on the DNC and DCCC networks , Second Lieutenant Artem Malyshev ( AKA " djangomagicdev " and " realblatr " ) monitored the implants through the command and control network configured for the task .


The information operations unit , Unit 74455 , was commanded by Colonel Aleksandr Vladimirovich Osadchuk .


Unit 74455 's members would be responsible for the distribution of some of the stolen data from the breaches through the " DCLeaks " and " Guccifer 2.0 " websites .


This group famously also reached out to WikiLeaks ( referred to as " Organization 1 " in the indictment ) to amplify their information operation , and they promoted the leaks to journalists through GRU -controlled email and social media accounts .


Within Unit 74455 , Officer Aleksy Potemkin—a department supervisor—oversaw information operations infrastructure .


His group configured the DCLeaks and Guccifer 2.0 blogs and social media accounts that would later be used to spread data stolen from the DNC , DCCC , and Clinton campaigns .


Bears in the Midst : Intrusion Into the Democratic National Committee .


There is rarely a dull day at CrowdStrike where we are not detecting or responding to a breach at a company somewhere around the globe .


In all of these cases , we operate under strict confidentiality rules with our customers and cannot reveal publicly any information about these attacks .


But on rare occasions , a customer decides to go public with information about their incident and give us permission to share our knowledge of the adversary tradecraft with the broader community and help protect even those who do not happen to be our customers .


This story is about one of those cases .


CrowdStrike Services Inc. , our Incident Response group , was called by the Democratic National Committee ( DNC ) , the formal governing body for the US Democratic Party , to respond to a suspected breach .


We deployed our IR team and technology and immediately identified two sophisticated adversaries on the network – COZY BEAR and FANCY BEAR .


We ’ve had lots of experience with both of these actors attempting to target our customers in the past and know them well .


In fact , our team considers them some of the best threat actors out of all the numerous nation-state , criminal and hacktivist/terrorist groups we encounter on a daily basis .


Their tradecraft is superb , operational security second to none and the extensive usage of ‘ living-off-the-land ’ techniques enables them to easily bypass many security solutions they encounter .


In particular , we identified advanced methods consistent with nation-state level capabilities including deliberate targeting and ‘ access management ’ tradecraft – both groups were constantly going back into the environment to change out their implants , modify persistent methods , move to new Command & Control channels and perform other tasks to try to stay ahead of being detected .


Both adversaries engage in extensive political and economic espionage for the benefit of the government of the Russian Federation and are believed to be closely linked to the Russian government ’s powerful and highly capable intelligence services .


COZY BEAR ( also referred to in some industry reports as CozyDuke or APT 29 ) is the adversary group that last year successfully infiltrated the unclassified networks of the White House , State Department , and US Joint Chiefs of Staff .


In addition to the US government , they have targeted organizations across the Defense , Energy , Extractive , Financial , Insurance , Legal , Manufacturing Media , Think Tanks , Pharmaceutical , Research and Technology industries , along with Universities .


Victims have also been observed in Western Europe , Brazil , China , Japan , Mexico , New Zealand , South Korea , Turkey and Central Asian countries .


COZY BEAR ’s preferred intrusion method is a broadly targeted spearphish campaign that typically includes web links to a malicious dropper .


Once executed on the machine , the code will deliver one of a number of sophisticated Remote Access Tools ( RATs ) , including AdobeARM , ATI-Agent , and MiniDionis .


On many occasions , both the dropper and the payload will contain a range of techniques to ensure the sample is not being analyzed on a virtual machine , using a debugger , or located within a sandbox .


They have extensive checks for the various security software that is installed on the system and their specific configurations .


When specific versions are discovered that may cause issues for the RAT , it promptly exits .


These actions demonstrate a well-resourced adversary with a thorough implant-testing regime that is highly attuned to slight configuration issues that may result in their detection , and which would cause them to deploy a different tool instead .


The implants are highly configurable via encrypted configuration files , which allow the adversary to customize various components , including C2 servers , the list of initial tasks to carry out , persistence mechanisms , encryption keys and others .


An HTTP protocol with encrypted payload is used for the Command & Control communication .


FANCY BEAR ( also known as Sofacy or APT 28 ) is a separate Russian-based threat actor , which has been active since mid 2000s , and has been responsible for targeted intrusion campaigns against the Aerospace , Defense , Energy , Government and Media sectors .


Their victims have been identified in the United States , Western Europe , Brazil , Canada , China , Georgia , Iran , Japan , Malaysia and South Korea .


Extensive targeting of defense ministries and other military victims has been observed , the profile of which closely mirrors the strategic interests of the Russian government , and may indicate affiliation with GRU , Russia ’s premier military intelligence service .


This adversary has a wide range of implants at their disposal , which have been developed over the course of many years and include Sofacy , X-Agent , X-Tunnel , WinIDS , Foozer and DownRage droppers , and even malware for Linux , OSX , IOS , Android and Windows Phones .


This group is known for its technique of registering domains that closely resemble domains of legitimate organizations they plan to target .


Afterwards , they establish phishing sites on these domains that spoof the look and feel of the victim ’s web-based email services in order to steal their credentials .


FANCY BEAR has also been linked publicly to intrusions into the German Bundestag and France ’s TV5 Monde TV station in April 2015 .


At DNC , COZY BEAR intrusion has been identified going back to summer of 2015 , while FANCY BEAR separately breached the network in April 2016 .


We have identified no collaboration between the two actors , or even an awareness of one by the other .


Instead , we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials .


While you would virtually never see Western intelligence agencies going after the same target without de-confliction for fear of compromising each other ’s operations , in Russia this is not an uncommon scenario . “ Putin ’s Hydra : Inside Russia ’s Intelligence Services ” , a recent paper from European Council on Foreign Relations , does an excellent job outlining the highly adversarial relationship between Russia ’s main intelligence services – FSB , the primary domestic intelligence agency but one with also significant external collection and ‘ active measures ’


remit , SVR , the primary foreign intelligence agency , and the aforementioned GRU .


Not only do they have overlapping areas of responsibility , but also rarely share intelligence and even occasionally steal sources from each other and compromise operations .


Thus , it is not surprising to see them engage in intrusions against the same victim , even when it may be a waste of resources and lead to the discovery and potential compromise of mutual operations .


The COZY BEAR intrusion relied primarily on the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with persistence accomplished via Windows Management Instrumentation ( WMI ) system , which allowed the adversary to launch malicious code automatically after a specified period of system uptime or on a specific schedule .


The Powershell backdoor is ingenious in its simplicity and power .


This one-line powershell command , stored only in WMI database , establishes an encrypted connection to C2 and downloads additional powershell modules from it , executing them in memory .


In theory , the additional modules can do virtually anything on the victim system .


The encryption keys in the script were different on every system .


Powershell version of credential theft tool MimiKatz was also used by the actors to facilitate credential acquisition for lateral movement purposes .


FANCY BEAR adversary used different tradecraft , deploying X-Agent malware with capabilities to do remote command execution , file transmission and keylogging .


It was executed via rundll32 commands such as : rundll32.exe “ C:\Windows\twain_64.dll ” .


In addition , FANCY BEAR ’s X-Tunnel network tunneling tool , which facilitates connections to NAT-ed environments , was used to also execute remote commands .


Both tools were deployed via RemCOM , an open-source replacement for PsExec available from GitHub .


Intelligence collection directed by nation state actors against US political targets provides invaluable insight into the requirements directed upon those actors .


Regardless of the agency or unit tasked with this collection , the upcoming US election , and the associated candidates and parties are of critical interest to both hostile and friendly nation states .


The 2016 presidential election has the world ’s attention , and leaders of other states are anxiously watching and planning for possible outcomes .


Corporate IoT – a path to intrusion .


Several sources estimate that by the year 2020 some 50 billion IoT devices will be deployed worldwide .


IoT devices are purposefully designed to connect to a network and many are simply connected to the internet with little management or oversight.Some IoT devices may even communicate basic telemetry back to the device manufacturer or have means to receive software updates .


In 2016 , the Mirai botnet was discovered by the malware research group MalwareMustDie .


The botnet initially consisted of IP cameras and basic home routers , two types of IoT devices commonly found in the household .


As more variants of Mirai emerged , so did the list IoT devices it was targeting .


The source code for the malware powering this botnet was eventually leaked online .


In 2018 , hundreds of thousands of home and small business networking and storage devices were compromised and loaded with the so-called “ VPN Filter ” malware .


The FBI has publicly attributed this activity to a nation-state actor and took subsequent actions to disrupt this botnet , although the devices would remain vulnerable to re-infection unless proper firmware or security controls were put in place by the user .


In April , security researchers in the Microsoft Threat Intelligence Center discovered infrastructure of a known adversary communicating to several external devices .


Further research uncovered attempts by the actor to compromise popular IoT devices ( a VOIP phone , an office printer , and a video decoder ) across multiple customer locations .


The investigation uncovered that an actor had used these devices to gain initial access to corporate networks .


In two of the cases , the passwords for the devices were deployed without changing the default manufacturer ’s passwords and in the third instance the latest security update had not been applied to the device .


These devices became points of ingress from which the actor established a presence on the network and continued looking for further access .


Once the actor had successfully established access to the network , a simple network scan to look for other insecure devices allowed them to discover and move across the network in search of higher-privileged accounts that would grant access to higher-value data .


After gaining access to each of the IoT devices , the actor ran tcpdump to sniff network traffic on local subnets .


They were also seen enumerating administrative groups to attempt further exploitation .


As the actor moved from one device to another , they would drop a simple shell script to establish persistence on the network which allowed extended access to continue hunting .


Analysis of network traffic showed the devices were also communicating with an external command and control ( C2 ) server .


The following IP addresses are believed to have been used by the actor for command and control ( C2 ) during these intrusions :


167.114.153.55 94.237.37.28 82.118.242.171 31.220.61.251 128.199.199.187 .


We attribute the attacks on these customers using three popular IoT devices to an activity group that Microsoft refers to as STRONTIUM .


Since we identified these attacks in the early stages , we have not been able to conclusively determine what STRONTIUM ’s ultimate objectives were in these intrusions .


Over the last twelve months , Microsoft has delivered nearly 1400 nation-state notifications to those who have been targeted or compromised by STRONTIUM .


One in five notifications of STRONTIUM activity were tied to attacks against non-governmental organizations , think tanks , or politically affiliated organizations around the world .


The remaining 80% of STRONTIUM attacks have largely targeted organizations in the following sectors : government , IT , military , defense , medicine , education , and engineering .


We have also observed and notified STRONTIUM attacks against Olympic organizing committees , anti-doping agencies , and the hospitality industry .


The “ VPN Filter ” malware has also been attributed to STRONTIUM by the FBI .


Below are a series of indicators Microsoft has observed as active during the STRONTIUM activity discussed in this article .


BRONZE PRESIDENT Targets NGOs .


The activities of some non-governmental organizations ( NGOs ) challenge governments on politically sensitive issues such as social , humanitarian , and environmental policies .


As a result , these organizations are often exposed to increased government-directed threats aimed at monitoring their activities , discrediting their work , or stealing their intellectual property .


BRONZE PRESIDENT is a likely People's Republic of China ( PRC )-based targeted cyberespionage group that uses both proprietary and publicly available tools to target NGO networks .


Secureworks Counter Threat Unit ( CTU ) researchers have observed BRONZE PRESIDENT activity since mid-2018 but identified artifacts suggesting that the threat actors may have been conducting network intrusions as far back as 2014 .


The BRONZE PRESIDENT cyberespionage group targets NGOs , as well as political and law enforcement organizations in countries in South and East Asia .


The threat group appears to have developed its own remote access tools that it uses alongside publicly available remote access and post-compromise toolsets .


After compromising a network , the threat actors elevate their privileges and install malware on a large proportion of systems .


The group runs custom batch scripts to collect specific file types and takes proactive steps to minimize detection of its activities .


Analysis of a threat group's targeting , origin , and competencies can determine which organizations could be at risk .


This information can help organizations make strategic defensive decisions in relation to the BRONZE PRESIDENT threat group .


CTU researchers have observed BRONZE PRESIDENT targeting multiple NGOs .


The threat actors steal data from compromised systems over a long period of time , which likely indicates a long-term objective of monitoring the target's network .


BRONZE PRESIDENT uses custom batch scripts to collect either specific file types ( including files with .pptx , .xlsx , .pdf extensions ) or all files within a specific location .


CTU researchers also observed evidence that the threat actors collect credentials from high-privilege network accounts and reputationally sensitive accounts , such as social media and webmail accounts .


Additionally , CTU researchers have observed evidence of BRONZE PRESIDENT targeting political and law enforcement organizations in countries adjacent to the PRC , including Mongolia and India .


Some of the group's phishing lures suggest an interest in national security , humanitarian , and law enforcement organizations in the East , South , and Southeast Asia ( see Figure 1 ) .


These examples reveal BRONZE PRESIDENT 's likely intent to conduct political espionage in other countries in addition to targeting NGOs .


It is highly likely that BRONZE PRESIDENT is based in the PRC due to the following observations :


The NGOs targeted by BRONZE PRESIDENT conduct research on issues relevant to the PRC .


Strong evidence links BRONZE PRESIDENT 's infrastructure to entities within the PRC .


There are connections between a subset of the group's operational infrastructure and PRC-based Internet service providers .


Tools such as PlugX have historically been leveraged by threat groups operating in the PRC .


It is likely that BRONZE PRESIDENT is sponsored or at least tolerated by the PRC government .


The threat group's systemic long-term targeting of NGO and political networks does not align with patriotic or criminal threat groups .


BRONZE PRESIDENT has deployed a variety of remote access tools .


The use of tools not previously observed by CTU researchers suggests that the group could have access to malware development capabilities .


BRONZE PRESIDENT also uses widely available or modified open-source tools , which could be a strategic effort to reduce the risk of attribution or to minimize the need for tool development resources .


Following a network compromise , the threat actors typically delete their tools and processes .


However , the group is content leaving some malware on the network , likely to provide a contingency if other access channels are removed .


When the group's activities were detected in one incident , it had elevated privileges and had maintained access to the targeted environment for several months .


This finding indicates the group's effectiveness at maintaining long-term access to a targeted network .


CTU researchers and Secureworks incident responders have observed BRONZE PRESIDENT using the following tools , along with several custom batch scripts for locating and archiving specific file types :


Cobalt Strike — This popular and commercially available penetration tool gains shell access to an infected system .


It allows threat actors to execute additional tools and perform post-intrusion actions on compromised systems .


Cobalt Strike appears to be one of BRONZE PRESIDENT 's preferred remote access tools .


During one intrusion , the threat actors installed it on over 70% of accessible hosts .


The group's Cobalt Strike installation typically uses a payload named svchost.exe in an attempt to disguise Cobalt Strike activity as the legitimate Windows svchost.exe executable .


PlugX — This remote access Trojan ( RAT ) is popular among PRC-based targeted threat groups .


Its functionality includes uploading and downloading files , and it has configurable network protocols .


BRONZE PRESIDENT installs PlugX using DLL side-loading .


In June and August 2019 , BRONZE PRESIDENT delivered PlugX via government and law enforcement-themed phishing lures .


ORat — CTU researchers have only observed this basic loader tool in the context of BRONZE PRESIDENT intrusions .


ORat is the name assigned by the malware author , as denoted by the program debug database string in the analyzed sample : D:\vswork\Plugin\ORat\build\Release\ORatServer\Loader.pdb .


The tool uses the Windows Management Instrumentation ( WMI ) event consumer for persistence by installing a script to the system's WMI registry .


Messages sent from ORat to its command and control ( C2 ) server start with the string "VIEWS0018x" .


If the data received from the C2 server starts with the same string , then the remainder of the payload is decompressed using ORat 's "deflate" algorithm and called as a function .


ORat acts as a flexible loader tool rather than a fully featured remote access tool .


RCSession — This basic RAT is installed via DLL side-loading , and CTU researchers observed BRONZE PRESIDENT installing it on multiple hosts during intrusions .


RCSession was extracted from a file called English.rtf and launched via a hollowed svchost.exe process .


RCSession connects to its C2 server via a custom protocol , can remotely execute commands , and can launch additional tools .


CTU researchers have no evidence of other threat actors using RCSession or of wide proliferation of the tool , suggesting it may be exclusively used by BRONZE PRESIDENT .


Nbtscan — This publicly available command-line tool scans systems for NetBIOS name information ( see Figure 2 ) .


In an example observed by CTU researchers , the Nbtscan executable was named Adobe.exe and was installed in several working directories on compromised hosts , including : C:\Recovery\ .


Nmap — BRONZE PRESIDENT used this freely available network scanning tool from the C:\PerfLogs\ folder .


Wmiexec — This publicly available tool uses WMI to create SYSTEM-level shells on remote hosts .


While analyzing hosts compromised by BRONZE PRESIDENT , CTU researchers identified other malware artifacts .


Although there was no evidence of the group using the malware , the threat actors may have leveraged its access or capabilities during earlier phases of the intrusions .


The BRONZE PRESIDENT intrusions observed by CTU researchers appear to have taken place over several months or years .