Input: Our illustration shows in abstract terms the use of Victim A's account to seed mal- ware ('' Aleppo Plan'') via (say) Skype messages to Victim (s) Bn.


Input: In the cases of Opp.


Input: Member C and NGO Worker D (here, actual victims, not abstract), targeting was by e-mail from domains apparently belonging to opposition groups, in- dicating a potential compromise.

targeting

by

e-mail from domains apparently belonging to opposition groups, in- dicating a potential compromise


Input: One domain remains active, hosting a website of the Salafist Al-Nusra front, while the other appears dormant.


Input: Opp. Member C received a malicious file as an e-mail attachment, while NGO Worker D was sent a shortened link (url [.] no/Uu5) to a download from a directory of Mrconstrucciones [.] net, a site that may have been com- promised.

Opp. Member C

a malicious file

an e-mail attachment

NGO Worker D

a shortened link (url [.] no/Uu5) to a download from a directory of Mrconstrucciones [.] net

received

was sent

as


Input: Both attacks resulted in an Xtreme RAT infection.

Both attacks

an Xtreme RAT infection

resulted

in


Input: Interestingly, in the case of the fake Skype encryption the deception extended to a YouTube video from'' IT Se- curity Lab'' demonstrating the program's purported ca- pabilities, as well as a website promoting the tool, skype- encryption.sytes.net.


Input: The attackers also constructed a ba- sic, faux GUI for their'' Encryption'' program (see Figure 4).


Input: The fake GUI has a number of non-functional buttons like'' En- crypt'' and'' DeCrypt,'' which generate fake prompts.


Input: While dis- tracted by this meaningless interaction, the victim's machine is infected with DarkComet 3.3 [,].

While

with

dis- tracted by this meaningless interaction

the victim's machine

DarkComet 3.3

is infected


Input: Anecdotally, campaign volume appears to track significant events in the ongoing conflict.


Input: For example, campaigns dwin- dled and then rebounded within hours after Syria's 2012 Inter- net shutdown.


Input: Similarly, activity observed by the authors also dwindled prior to expectation of US-led military action against Syrian government targets in September 2013.


Input: Once this option appeared to be off the table, the volume of new samples and campaigns we observed again increased, includ- ing the recent targeting of NGO workers per Figure 3.


Input: We are aware of only a negligible number of cases of the opposition using similar RATs against Syrian Government supporters, al- though evidence exists of other kinds of electronic attacks by third parties.


Input: The logistics and activities of Syria's numerous opposition groups are intentionally concealed from public view to protect both their efficacy, and the lives of people participating in them.


Input: Nevertheless, Syrian opposition members are generally familiar with stories off digital compro- mises of high-profile figures, including those entrusted with the most sensitive roles, as well as rank-and-file members.


Input: Com- promise of operational security poses a documented threat to life both for victims of electronic compromise, and to family members and associates.


Input: The Syrian conflict is ongoing, making it difficult to assem- ble comprehensive evidence of linkages between government actors and malware campaigns.


Input: Moreover, many individuals whose identities have been compromised are in prison or oth- erwise disappeared, and thus unable to relate the evidence pre- sented to them during interrogation.


Input: Still, strong circumstantial evidence links the use of RATs, phishing, and government ac- tivity, which we briefly summarize here: (1) many Syrians have recounted to journalists and the authors how interrogators con- fronted them with material from their computers.


Input: For example: The policeman told me,'' Do you remember when you were talking to your friend and you told him you had something wrong [sic] and paid a lot of money? At that time we were taking information from your laptop.


Input: '' (2) Syrian activists have supplied cases to international journal- ists, where arrests are quickly followed by the social me- dia accounts of detained individuals seeding malware to contact lists (Figure 3).


Input: (3) Finally, despite the notoriety of the attack campaigns, including mention of C & C IPs in international me- dia, the Syrian government has made no public statements about these campaigns nor acted to shut down the servers.


Input: Beyond the ongoing challenges of attribution, these malware campaigns have a tangible impact on the Syrian opposition, and generally align with the interests of the Syrian government's propaganda operations.


Input: The case of Abdul Razzaq Tlass, a leader in the Free Syrian Army, is illustrative of the potential uses of such campaigns.


Input: In 2012 a string of videos emerged showing Tlass sexting and engaged in lewd activity in front of a webcam.


Input: While he denied the videos, the harm to his rep- utation was substantial and he was eventually replaced.


Input: While the UAE has experienced no recent uprising or politi- cal unrest, it has nevertheless cracked down on its opposition, concurrent with the Arab Spring.


Input: The first attacks we observed in the UAE involved a government-grade'' lawful interception'' trojan known as Re- mote Control System (RCS), sold by the Italian company Hack- ing Team.

The first attacks

a government-grade'' lawful interception'' trojan known as Re- mote Control System (RCS), sold by the Italian company Hack- ing Team

involved


Input: The associated C & C server indicated direct UAE government involvement.


Input: Over time, we stopped receiving RCS samples from UAE targets, and instead observed a shift to the use of off-the-shelf RATs, and possible involvement of cyber-mercenary groups.


Input: However, poor attacker operational security .allowed


Input: us to link most observed attacks together.


Input: UAE activist Ahmed Mansoor (per Figure 5), impris- oned from April to November 2011 after signing an online pro- democracy petition, received an e-mail purportedly from'' Arabic Wikileaks'' in July 2012.


Input: He opened the associated at- tachment,'' veryimportant.doc,'' and saw what he described as'' scrambled letters''.


Input: He forwarded us the e-mail for investiga- tion.


Input: The attachment exploited CVE-2010-3333, an RTF pars- ing vulnerability in Microsoft Office.


Input: The document did not contain any bait content, and part of the malformed RTF that triggered the exploit was displayed in the document.


Input: The exploit loaded shellcode that downloaded a second stage from ar-24.com, which in turn downloaded spyware from ar-24.com.

The exploit

shellcode

a second stage

spyware

loaded

downloaded

downloaded

from

from


Input: We denote this combination as the 3-Stage Ex- ploit Kit in Figure 5.


Input: The C & C server also ran on ar-24.com.

The C & C server

ran

on


Input: When we ob- tained the sample in July 2012, ar-24.com resolved to an IP address on Linode, a hosting provider.


Input: Three months later, it resolved to a UAE address belonging to the Royal Group, an organization linked to the UAE government; it is chaired by Sheikh Tahnoon bin Zayed Al-Nayhan, a member of the UAE ruling family and a son of the founder of the UAE.


Input: Identification as RCS: We identified strings in memory that matched those in a Symantec analysis of RCS (also known as DaVinci or Crisis), a product of the Italian com- pany Hacking Team.


Input: We also located a structurally sim- ilar Word document via VirusTotal.


Input: The document used the same exploit and attempted to download a second stage from rcs-demo.hackingteam.it, which was unavailable at the time of testing.

The document

a second stage

rcs-demo.hackingteam.it

download

from


Input: Analysis of capabilities: RCS has a suite of functionality largely similar to FinSpy.


Input: One difference was in the vectors used to install the spyware.

the vectors

the spyware

install


Input: We located additional samples (see § 5), some of which were embedded in a .jar file that installs an OS-appropriate version of RCS (Windows or OSX), option- ally using an exploit.

a .jar file

an OS-appropriate version of RCS

installs


Input: If embedded as an applet, and no exploit is present, Java displays a security warning and asks the user whether they authorize the installation.


Input: We also saw instances of the 3-Stage Exploit Kit where the first stage contained a Flash exploit; in some cases, we could obtain all stages and confirm that these installed RCS.

these

RCS

installed


Input: Some samples were packed with the MPress packer, and some Windows samples were obfuscated to look like the PuTTY SSH client.

some Windows samples

look like the PuTTY SSH client

were obfuscated

to


Input: Another difference is in persistence.


Input: For example, the RCS sample sent to Ahmed adds a Run registry key, whereas the FinSpy samples used in Bahrain overwrite the hard disk's boot sector to modify the boot process; the spyware is loaded be- fore the OS, and injects itself into OS processes as they start.

the RCS sample sent to Ahmed

a Run registry key

the FinSpy samples used in Bahrain

the hard disk's boot sector

the boot process

the spyware

the OS

itself

OS processes

they start

adds

overwrite

modify

is loaded

injects

be- fore

into

as


Input: The RCS samples we examined also had the ability to propa- gate to other devices, including into inactive VMWare virtual machines by modifying the disk image, onto USB flash drives, and onto Windows Mobile phones.

The RCS samples we examined

other devices

inactive VMWare virtual machines

modifying the disk image

USB flash drives

Windows Mobile phones

propa- gate

to

into

by

onto

onto


Input: We did not observe similar capabilities in the FinSpy samples we examined.


Input: Exploitation of captured data: When Ahmed Mansoor re- ceived the RCS document, he opened it, infecting his computer (Figure 5).


Input: Ahmed subsequently noted several suspicious ac- cesses to his GMail account using IMAP.

ac- cesses

to

using

his GMail account

IMAP


Input: Even after he changed his password, the accesses continued.

Even after

he changed his password

the accesses

continued


Input: While corresponding with Ahmed on his compromised account, an author of this pa- per discovered that the attackers had installed an application- specific password in Ahmed's GMail account, a secondary password that they apparently used to access his account even after he changed his main password.

a secondary password

they

access his account

he changed his main password

used

to

even after


Input: The suspicious accesses stopped after removal of the application-specific password.


Input: Two weeks after this correspondence with Ahmed, one of us (Author in Figure 5) received a targeted e-mail with a link to a file hosted on Google Docs containing a commercial off-the- shelf RAT, Xtreme RAT.

one of us

a targeted e-mail with a link to a file hosted on Google Docs containing a commercial off-the- shelf RAT, Xtreme RAT

received


Input: The e-mail was sent from the UAE's timezone (as well as of other countries) and contained the terms'' veryimportant'' and'' wikileaks'', just like in the e-mail re- ceived by Ahmed.


Input: The instance of Xtreme RAT sent to Author used owner.no-ip.biz for its C & C, one of the domains men- tioned in a report published by Norman about a year-long cam- paign of cyberattacks on Israeli and Palestinian targets carried out by a group that Norman was unable to identify.

The instance of Xtreme RAT sent to Author

owner.no-ip.biz

its C & C

used

for


Input: Three months after Author was targeted, Ahmed received an e-mail containing an attachment with Xtreme RAT that talked to the same C & C server (Figure 5), suggesting that the attackers who infected Ahmed with RCS may have provided a list of interest- ing e-mail addresses to another group for further targeting.

Ahmed

an e-mail containing an attachment

Xtreme RAT

the same C & C server

received

talked

with

to


Input: Possible consequences: Shortly after he was targeted, Ahmed says he was physically assaulted twice by an attacker who appeared able to track Ahmed's location.


Input: He also re- ports that his car was stolen, a large sum of money disappeared from his bank account, and his passport was confiscated.


Input: He believes these consequences are part of a government in- timidation campaign against him, but we did not uncover any direct links to his infection.


Input: (Interestingly, spyware subse- quently sent to others has used bait content about Ahmed.

spyware subse- quently sent to others

bait content about Ahmed

used


Input: ) Further attacks: In October 2012, UAE Journalist A and Human Rights activist B (per Figure 6) forwarded us suspi- cious e-mails they had received that contained a Word docu- ment corresponding to the first stage of 3-Stage Exploit Kit (Figure 5).

suspi- cious e-mails

they

that contained a Word docu- ment corresponding to the first stage of 3-Stage Exploit Kit

received


Input: The attachment contained an embedded Flash file that exploited a vulnerability fixed in Adobe Flash 11.4, loading shell code to download a second stage from faddeha.com.

an embedded Flash file that exploited a vulnerability fixed in Adobe Flash 11.4

shell code

a second stage

faddeha.com

loading

download

from


Input: We were unable to obtain the second stage or the ultimate pay- load, as the website was unavailable at the time of testing.


Input: However, the exploit kit appears indicative of Hacking Team involvement.


Input: A page on faddeha.com found in Google's cache contained an embedded .jar


Input: with the same applet class (WebEnhancer) as those observed in other .jar


Input: files that we found to contain RCS.


Input: We found a file that VirusTotal had downloaded from faddeha.com, which appeared to be a re- mote access toolkit known as SpyNet, available for general pur- chase for 50 Euros.


Input: The SpyNet sample communicated with the C & C hamas.sytes.net.

The SpyNet sample

the C & C hamas.sytes.net

communicated

with


Input: SpyNet Packing: We found another instance of the first stage of the 3-Stage Exploit Kit on VirusTotal.


Input: The exploit downloaded a second stage, which in turn downloaded a sam- ple of SpyNet from maile-s.com.

The exploit

a second stage

a sam- ple of SpyNet

maile-s.com

downloaded

downloaded

from


Input: This sample of SpyNet communicated with the same C & C hamas.sytes.net.

This sample of SpyNet

the same C & C hamas.sytes.net

communicated

with


Input: The sample was packed using ASProtect.


Input: When run, the sample unpacks a compiled Visual Basic project that loads, via the RunPE method, an executable packed with UPX.

a compiled Visual Basic project

the RunPE method

an executable packed with UPX

loads

via


Input: Finally, this executable unpacks SpyNet.


Input: SpyNet's GUI only offers an option to pack with UPX, suggesting that the attack- ers specially added the other layers of packing.


Input: In some cases, the Visual Basic project bears the name NoWayTech, which appears to be an underground RunPE tool, while others are named SpyVisual, which we have been unable to trace to any public underground tools, and thus also may reflect customiza- tion by the attacker.


Input: The SpyVisual projects contain the string c: \Users\Zain\AppData\Local\Temp\OLE1EmbedStrm.wav, which we used as the fingerprint VB Packer in Figure 6.


Input: Cedar Key attack: The same VB Packer was used in an attack on Relative of political detainee D and H.R.


Input: activist E in Figure 6.


Input: These individuals received e-mails containing a link to a web page hosted on cedarkeyrv.com impersonat- ing YouTube.

These individuals

e-mails containing a link to a web page hosted on cedarkeyrv.com impersonat- ing YouTube

received


Input: Loading the page greeted the target with'' Video loading please wait.


Input: '' The page redirected to a YouTube video a few seconds later, but first loaded a Java exploit -a known vulnerability with no patch at the time that the e-mails were sent.

The page

a Java exploit

loaded


Input: Oracle released a patch 12 hours after activists began receiving these links.


Input: The cedarkeyrv.com domain is associated with an RV park in Cedar Key, Florida.


Input: The website's hosting company told us that the site had apparently suffered a compromise, but did not have further details.


Input: The exploit used in the attack appears to have been origi- nally posted by a Kuwaiti user, njq8, on an Arabic-language exploit sharing site.


Input: We contacted njq8, who told us that he had obtained the exploit elsewhere and modified it prior to posting.


Input: The attack downloaded an instance of SpyNet from isteeler.com (which from our inspection did not appear to have any legitimate content), which used the C & C storge.myftp.org.

The attack

an instance of SpyNet

isteeler.com

the C & C storge.myftp.org

downloaded

used

from


Input: This same C & C occurred in an- other attack (Figure 6) targeting Relative of political detainee D; in that case, the payload was a freely-available RAT known as njRAT, written by the same njq8 as the exploit-poster dis- cussed above.


Input: However, we did not find any other evidence suggesting njq8's involvement in either attack.


Input: More SpyNet attacks: The domain hamas.sytes.net, which we previously saw used by two SpyNet sam- ples, resolved to 67.205.79.177.


Input: Historically, dreems.no-ip.ca also resolved to this address.


Input: An unidentified dropper using this C & C targeted Journalist F; a SpyNet attack on Relative of political detainee D also used this C & C.

An unidentified dropper

this C & C

a SpyNet attack on Relative of political detainee D

this C & C

using

used


Input: In that latter case, the sample arrived via e-mail in a .rar attachment that contained an .scr file disguised as a Word document.

the sample

e-mail

a .rar attachment

an .scr file

a Word document

arrived

disguised

via

in

as


Input: The .scr file was a self-extracting archive that decompressed and ran both the bait document and the payload.

The .scr file

both the bait document and the payload

ran


Input: The SMTP source of the e-mail was webmail.upload.bz.


Input: Appin: In early 2013 UAE H.R.


Input: activist E forwarded nu- merous documents that included a particular CVE-2012-0158 exploit for Microsoft Word.


Input: In all, these totaled 17 distinct hashes of documents, and 10 distinct hashes of payloads (some documents that differed in their hash downloaded the same pay- load).

some documents that differed in their hash

the same pay- load

downloaded


Input: The exploits primarily downloaded instances of SpyNet from upload.bz, which for the most part communicated with C & C at sn.all-google.com.

The exploits

instances of SpyNet

upload.bz

C & C at sn.all-google.com

downloaded

communicated

from

with


Input: This domain was also used for C & C in other attacks, including that on Journalist C. Two of the other CVE-2012-0158 exploits down- loaded DarkComet from www.getmedia.us and www.technopenta.com after posting system infor- mation to random123.site11.com.

This domain

C & C in other attacks

Two of the other CVE-2012-0158 exploits

DarkComet

www.getmedia.us and www.technopenta.com

system infor- mation

was also used

down- loaded

posting

for

from

to


Input: All three domains match those used by an Indian cybermercenary group said to be linked to Appin Security Group.


Input: The former two domains hosted content other than spyware (i.e., they may have been compromised).


Input: We alerted the owner of www.getmedia.us, who removed the payloads.


Input: The samples we received afforded us an opportunity to em- pirically characterize the use of FinFisher and Hacking Team around the world, enabling us to assess their prevalence, and identify other country cases that may warrant future investiga- tion.


Input: We analyzed the samples and the behavior of their C & C servers to develop indicators (fingerprints) for how the servers respond to certain types of requests.


Input: We then scanned the full Internet IPv4 address space ('' /0'') for these, along with prob- ing results found by past scans.


Input: In many cases we do not release the full details of our fingerprints to avoid compromising what may be legitimate investigations.


Input: Identifying and linking servers: We developed a number of fingerprints for identifying FinSpy servers using HTTP- based probing as well as FinSpy's custom TLV-based proto- col. We leveraged quirks such as specific non-compliance with RFC 2616, responses to certain types of invalid data, and the presence of signatures such as the bizarre'' Hallo Steffi'' that Guarnieri identified from Bahraini FinSpy C & C servers [,].


Input: See Appendix A for details.


Input: We then exhaus- tively scanned the Internet looking for matches to these finger- prints.


Input: Gamma documentation advertises that an operator of FinSpy can obscure the location of the C & C server (called the mas- ter) by setting up a proxy known as a relay.

an operator of FinSpy

the location of the C & C server (called the mas- ter)

setting up a proxy known as a relay

obscure

by


Input: In Spring 2013 we noticed FinSpy servers now issuing 302 Redirects to google.com.


Input: However, we noticed anomalies: for ex- ample, servers in India were redirecting to the Latvian ver- sion of Google google.lv.


Input: We suspect that the server in India was a relay forwarding to a master in Latvia.


Input: Be- cause the master served as a proxy for Google, we could uncover its IP address using a Google feature that prints a user's IP address for the query'' IP address.


Input: '' We created an additional fingerprint based on the proxying behavior and is- sued GET /search? q=ip+address & nord=1 requests to servers We note some interesting master locations in Table 4.


Input: Server locations: In all, our fingerprints matched 92 dis- tinct IP addresses in 35 different countries.


Input: Probing these on 8/8/13 revealed 22 distinct addresses still responding, sited in: Bahrain, Bangladesh, Bosnia and Herzegovina, Estonia, Ethiopia, Germany, Hong Kong, Indonesia, Macedonia, Mex- ico, Romania, Serbia, Turkmenistan, and the United States.


Input: We found servers responding to a number of our fingerprints, sug- gesting either that some servers lag in their updates, or a con- certed effort to vary the behavior of FinSpy servers to make detection harder.


Input: We found: (1) 3 IP addresses in ranges registered to Gamma.


Input: (2) Servers in 3 IP ranges explicitly registered to govern- ment agencies: Turkmenistan's Ministry of Communications, Qatar's State Security Bureau, and the Bulgarian Council of Ministers.


Input: (3) 3 additional IP addresses in Bahrain, all in Batelco.


Input: (4) Servers in 7 countries with governments classified as'' authoritarian regimes'' by The Economist: Bahrain, Ethiopia, Nigeria, Qatar, Turkmenistan, UAE, Vietnam.


Input: Additional FinSpy samples: In parallel to our scanning, we obtained 9 samples of FinSpy by writing YARA rules for the'' malware hunting'' feature of VirusTotal Intelligence.


Input: This feature sends us all newly-submitted samples that match our signatures.


Input: We located a version of FinSpy that does not use the normal FinSpy handshake, but instead uses a protocol based on HTTP POST requests for communication with the C & C server.

a version of FinSpy

a protocol based on HTTP POST requests

communication with the C & C server

uses

for


Input: This did not appear to be an older or newer ver- sion of the protocol, suggesting that our scan results may not reveal the full scope of FinSpy C & C servers.


Input: Perhaps, the HTTP POST protocol was only delivered to a specific Gamma customer to meet a requirement.


Input: We began by analyzing the UAE RCS sample from Ahmed and 6 samples obtained from VirusTotal by searching for AV re- sults containing the strings'' DaVinci'' and'' RCS.


Input: '' At the time, several AV vendors had added detection for RCS based on a sample analyzed by Dr.


Input: Web and the UAE RCS sample sent to Ahmed.


Input: We also similarly obtained and analyzed sam- ples of FSBSpy, a piece of malware that can report system information, upload screenshots, and drop and execute more malware.

a piece of malware

system information

screenshots

more malware

report

upload

drop and execute


Input: Based on these samples, we devised YARA signa- tures that yielded 23 additional samples of structurally similar malware.


Input: Fingerprints: We probed the C & C servers of the RCS and FSBSpy samples, and found that they responded in a distinc- tive way to HTTP requests, and returned distinctive SSL cer- tificates.


Input: We searched sources including Shodan, 5 Internet Census service probes, and Critical.IO scanning data for the observed distinctive HTTP behavior.


Input: We searched for the dis- tinctive SSL certificates in two Internet Census service probes, and SSL certificate scans from ZMap.


Input: We also contacted a team at TU Munich, who applied our fingerprints to their SSL scanning data.


Input: Across all of these sources, we obtained 31,345 indicator hits reflecting 555 IP addresses in 48 coun- tries.


Input: One SSL certificate returned by 175 of the servers was issued by'' /CN=RCS Certification Authority /O=HT srl,'' apparently referring to the name of the spyware and the company.


Input: Servers for 5 of our FSBSpy samples and 2 of our RCS samples re- sponded with this type of certificate.


Input: Some servers returned these certificates in chains that in- cluded another distinctive certificate.


Input: We found 175 distinct IP addresses (including the C & C's for 5 of our FSBSpy samples and 2 of our RCS samples) responded with this second type of certificate.


Input: We devised two more indicators: one that matched 125 IP addresses, including 7 of our FSBSpy samples' C & C's, and one that matched 2 IP addresses, in Italy and Kazakhstan.


Input: Server locations: On 11/4/13 we probed all of the IP ad- dresses that we collected, finding 166 active addresses match- ing one of our fingerprints in 29 different countries.


Input: We sum- marize the top providers and countries in Table 5.


Input: The prevalence of active servers either located in the USA or hosted by Linode is striking, and seems to indicate a pervasive use of out-of-country web hosting and VPS services.


Input: In addition, we found: (1) 3 IP addresses on a /28 named'' HT public subnet'' that is registered to the CFO of Hacking Team.


Input: The domain hackingteam.it resolves to an address in this range.


Input: (2) An address belonging to Omantel, a majority-state-owned telecom in Oman.


Input: This address was un- reachable when we probed it; a researcher pointed us to an FS- BSpy sample that contained an Arabic-language bait document about Omani poetry, which talked to a C & C in the UK.

an FS- BSpy sample

an Arabic-language bait document about Omani poetry

a C & C in the UK

contained

talked

to


Input: (3) 7 IP addresses belonging to Maroc Telecom.


Input: Moroccan journal- ists at Mamfakinch.com were previously targeted by RCS in 2012.


Input: (4) Overall, servers in 8 countries with governments deemed'' authoritarian regimes'': Azerbaijan, Kazakhstan, Nigeria, Oman, Saudi Arabia, Sudan, UAE, Uzbekistan.


Input: Link to Hacking Team: All active servers match- ing one of our signatures also responded peculiarly when queried with particular ill-formed HTTP requests, respond- ing with'' HTTP1/1 400 Bad request'' (should be'' HTTP/1.1'') and a body of'' Detected error: HTTP code 400''.


Input: Googling for this response yielded a GitHub project em-http-server, a Ruby-based webserver.


Input: The project's author is listed as Alberto Ornaghi, a software architect at Hacking Team.


Input: We suspect that the Hacking Team C & C server code may incorporate code from this project.


Input: Links between servers: We identified many cases where several servers hosted by different providers, and in different countries, returned identical SSL certificates matching our fin- gerprints.


Input: We also observed 30 active servers used a global IPID.


Input: Only one active server had neither a global IPID nor an SSL certificate matching our fingerprints.


Input: We assessed whether servers returning SSL certificates were forwarding to the servers with global IPIDs by inducing bursts of traffic at the former and monitoring the IPID at the latter.


Input: For 11 servers, we found that the server's activity correlated to bursts sent to other servers.


Input: We grouped servers by the SSL certificates they returned, and found that each group forwarded to only a sin- gle server, except for one case where a group forwarded to two different IPs (both in Morocco).

each group

only a sin- gle server

a group

two different IPs

forwarded

forwarded

to

to


Input: We also found two groups that forwarded to the same address.

two groups

the same address

forwarded

to


Input: There was a 1:1 mapping between the remaining 8 addresses and groups.


Input: We refer to a group along with the server (s) it forwards to as a server group.


Input: We identified several server groups that may be associated with victims or operators in a certain country.


Input: Some of these suggest possible further investigation: Turkey: We identified a group containing 20 servers in 9 countries.


Input: Two RCS and 5 FSBSpy samples from VirusTo- tal communicated with various servers in the group.

Two RCS and 5 FSBSpy samples from VirusTo- tal

various servers in the group

communicated

with


Input: The RCS samples also communicated with domains with lapsed registra- tions, so we registered them to observe incoming traffic.

The RCS samples

domains with lapsed registra- tions

communicated

with


Input: We ex- clusively received RCS traffic from Turkish IP addresses.


Input: (RCS traffic is identifiable based on a distinctive user agent and URL in POST requests.


Input: ) A sample of FSBSpy apparently installed from an exploit on a Turkish server talked to one of the servers in this group.

A sample of FSBSpy

one of the servers in this group

talked

to


Input: We also found server groups containing servers in Uzbek- istan and Kazakhstan; we found FSBSpy samples on Virus- Total uploaded from these countries that communicated with servers in these groups.

FSBSpy samples on Virus- Total uploaded from these countries

servers in these groups

communicated

with


Input: In the above cases, save Turkey, the country we have identi- fied is classified as an'' authoritarian regime,'' and may be using Hacking Team products against the types of targets we profile in this paper.


Input: In the case of Turkey, there are hints that the tool may be employed against dissidents.


Input: Targeted surveillance of individuals conducted by nation-states poses an exceptionally challenging security problem, given the great imbalance of resources and expertise between the victims and the attackers.


Input: We have sketched the nature of this problem space as reported to us by targeted individuals in three Middle Eastern countries.


Input: The attacks include spyware for ongoing monitoring and the use of'' IP spy'' links to deanonymize those who voice dissent.

The attacks

spyware for ongoing monitoring

the use of'' IP spy'' links to deanonymize those who voice dissent

include


Input: The attacks, while sometimes incorporating effective so- cial engineering, in general lack novel technical elements.

The attacks

effective so- cial engineering

incorporating


Input: In- stead, they employ prepackaged tools developed by vendors or acquired from the cybercrime underground.


Input: This technol- ogy sometimes suffers from what strike us as amateurish mis- takes (multiple serious errors implementing cryptography, bro- ken protocol messages), as does the attackers' employment of it (identifying-information embedded in binaries, C & C servers discoverable via scanning or'' Google hacking'', clusters of at- tack accounts tied by common activity).


Input: Some of these errors assisted our efforts to assemble strong circumstantial evidence of governmental origins.


Input: In addition, we mapped out the global use of two'' governmental'' hacking suites, including identify- ing 11 cases in which they appeared to be used in countries governed by'' authoritarian regimes.


Input: '' We aim with this work to inspire additional research efforts addressing the difficult problem of how to adequately protect individuals with very limited resources facing very powerful adversaries.


Input: Open questions include robust, practical detection of targeted attacks designed to exfiltrate data from a victim's computer, as well as detection of and defense against novel at- tack vectors, like tampering with Internet connections to insert malware.


Input: The task is highly challenging, but the potential stakes are likewise very high.


Input: An opposition member, reflecting on gov- ernment hacking in Libya, speculated as to why some users would execute files even while recognizing them as potentially malicious:'' If we were vulnerable we couldn't care less.


Input: we were desperate to get our voices out.


Input: it was a matter of life or death.


Input: it was just vital to get this information out.


Input: '' This work was supported by the National Science Foundation under grants 1223717 and 1237265, and by a Citizen Lab Fel- lowship.


Input: Any opinions, findings, and conclusions or recom- mendations expressed in this material are those of the authors and do not necessarily reflect the views of the sponsors.


Input: The authors would like to thank the following individuals for their help in various aspects of our analysis: Bernhard Am- man, Collin D. Anderson, Brandon Dixon, Zakir Durumeric, Eva Galperin, Claudio Guarnieri, Drew Hintz, Ralph Holz, Shane Huntley, Andrew Lyons, Mark Schloesser, and Nicholas Weaver.


Input: Previous work by Guarnieri on scanning for FinSpy servers found that in response to a request such as GET/, the Bahraini FinSpy C & C server returns a response with the string'' Hallo Steffi''.


Input: Guarnieri searched a database of such responses compiled by the Critical.IO Internet scanning project, locating 11 additional servers in 10 countries.


Input: We refer to this fingerprint as α1.


Input: Concurrent with this ef- fort, we devised our own fingerprint β1 that tested three as- pects of the handshake between a FinSpy infectee and a Fin- Spy C & C server, which follows a custom TLV-based protocol running on ports such as 22, 53, 80, and 443.


Input: We conducted targeted scanning of several countries using β1, and also con- firmed Guarnieri's findings for those servers still reachable af- ter he published his findings.


Input: We observed a trend: changes in HTTP response behavior by FinFisher after publication of findings about the software.


Input: In July 2012, for example, after a post about Bahraini FinSpy samples, servers closed the TCP connection in response to a GET/or HEAD/request (although servers continued to behave consistently with β1.


Input: Other changes followed later in 2012, including a new response to GET/requests that in- cluded an imperfect copy of an Apache server's HTTP response (the Date header used UTC rather than GMT).


Input: We fingerprinted this error as α2, and later in 2012 fingerprinted other distinctive behavior in response to GET/requests as α3.


Input: Subsequent scans of /0 for α2 and α3, and five service probes of the Internet Census for α1 through α3, located several additional servers.


Input: In Feburary 2013 we identified and finger- printed new HTTP response behavior with α4 and modified β1 to produce β2, which tests only two of the three aspects of the FinSpy handshake (the third test of β1 was broken when Fin- Spy servers were updated to accept types of invalid data they had previously rejected).


Input: As of 3/13/13, all servers that matched any α fingerprint matched β2.


Input: Our clients often ask us to assess the threat Russia poses in cyberspace.


Input: Russia has long been a whispered frontrunner among capable nations for performing sophisticated network operations.


Input: This perception is due in part to the Russian government's alleged involvement in the cyber attacks accompanying its invasion of Georgia in 2008, as well as the rampant speculation that Moscow was behind a major U.S. Department of Defense network compromise, also in 2008.


Input: These rumored activities, combined with a dearth of hard evidence, have made Russia into something of a phantom in cyberspace.


Input: In this paper we discuss a threat group whose malware is already fairly well-known in the cybersecurity community.


Input: This group, unlike the China-based threat actors we track, does not appear to conduct widespread intellectual property theft for economic gain.


Input: Nor have we observed the group steal and profit from financial account information.


Input: The activity that we profile in this paper appears to be the work of a skilled team of developers and operators collecting intelligence on defense and geopolitical issues–intelligence that would only be useful to a government.


Input: We believe that this is an advanced persistent threat (APT) group engaged in espionage against political and military targets including the country of Georgia, Eastern European governments and militaries, and European security organizations since at least 2007.


Input: They compile malware samples with Russian language settings during working hours consistent with the time zone of Russia's major cities, including Moscow and St. Petersburg.


Input: While we don't have pictures of a building, personas to reveal, or a government agency to name, what we do have is evidence of long- standing, focused operations that indicate a government sponsor–specifically, a government based in Moscow.


Input: We are tracking this group as APT28.


Input: APT28 targets insider information related to governments, militaries, and security organizations that would likely benefit the Russian government.


Input: Malware compile times suggest that APT28 developers have consistently updated their tools over the last seven years.


Input: Since 2007, APT28 has systematically evolved its malware, using flexible and lasting platforms indicative of plans for long-term use.


Input: The coding practices evident in the group's malware suggest both a high level of skill and an interest in complicating reverse engineering efforts.


Input: • Malware compile times suggest that APT28 developers have consistently updated their tools over the last seven years.


Input: • APT28 malware, in particular the family of modular backdoors that we call CHOPSTICK, indicates a formal code development environment.


Input: Such an environment would almost certainly be required to track and define the various modules that can be included in the backdoor at compile time.


Input: • APT28 tailors implants for specific victim environments.


Input: They steal data by configuring their implants to send data out of the network using a victim network's mail server.

They

data

their implants

data

the network

a victim network's mail server

steal

send

out of

using


Input: • Several of APT28's malware samples contain counter- analysis capabilities including runtime checks to identify an analysis environment, obfuscated strings unpacked at runtime, and the inclusion of unused machine instructions to slow analysis.

Several of APT28's malware samples

counter- analysis capabilities

runtime checks

an analysis environment

obfuscated strings

runtime

inclusion of unused machine instructions

analysis

contain

identify

unpacked

slow

at


Input: Indicators in APT28's malware suggest that the group consists of Russian speakers operating during business hours in Russia's major cities.


Input: More than half of the malware samples with Portable Executable (PE) resources that we have attributed to APT28 included Russian language settings (as opposed to neutral or English settings), suggesting that a significant portion of APT28 malware was compiled in a Russian language build environment consistently over the course of six years (2007 to 2013).


Input: Over 96% of the malware samples we have attributed to APT28 were compiled between Monday and Friday.


Input: More than 89% were compiled between 8AM and 6PM in the UTC+4 time zone, which parallels the working hours in Moscow and St. Petersburg.


Input: These samples had compile dates ranging from mid-2007 to September 2014.


Input: Three themes in APT28's targeting clearly reflect areas of specific interest to an Eastern European government, most likely the Russian government.


Input: Many of APT28's targets align generally with interests that are typical of any government.


Input: However, three themes in APT28's targeting clearly reflects areas of specific interest to an Eastern European government, most likely the Russian government.


Input: These include the Caucasus (especially the Georgian government), Eastern European governments and militaries, and specific security organizations.


Input: APT28 uses spearphishing emails to target its victims, a common tactic in which the threat group crafts its emails to mention specific topics (lures) relevant to recipients.

spearphishing emails

target its victims

the threat group

its emails

mention specific topics (lures) relevant to recipients

uses

crafts

to

to


Input: This increases the likelihood that recipients will believe that the email is legitimate and will be interested in opening the message, opening any attached files, or clicking on a link in the body of the email.


Input: Since spearphishing lures are tailored to the recipients whose accounts APT28 hopes to breach, the subjects of the lures provide clues as to APT28's targets and interests.


Input: For example, if the group's lures repeatedly refer to the Caucasus, then this most likely indicates that APT28 is trying to gain access to the accounts of individuals whose work pertains to the Caucasus.


Input: Similarly, APT28's practice of registering domains that mimic those of legitimate news, politics, or other websites indicates topics that are relevant to APT28's targets.


Input: We identified three themes in APT28's lures and registered domains, which together are particularly relevant to the Russian government.


Input: In addition to these themes, we have seen APT28 target a range of political and military organizations.


Input: We assess that the work of these organizations serves nation state governments.


Input: The Caucasus, a region that includes Chechnya and other Russian republics and the independent states of Georgia, Armenia, and Azerbaijan, continues to experience political unrest.


Input: The Georgian government's posture and ties to the West are a frequent source of Moscow's frustration, particularly after the 2008 war.


Input: Overall, issues in the Caucasus likely serve as focal points for Russian intelligence collection efforts.


Input: Since 2011, APT28 has used lures written in Georgian that are probably intended to target Georgian government agencies or citizens.

lures written in Georgian

used


Input: APT28 is likely seeking information on Georgia's security and diplomatic postures.


Input: Specifically, the group has targeted the Georgian Ministry of Internal Affairs (MIA) and the Ministry of Defense (MOD).


Input: We also observed efforts to target a journalist working on issues in the Caucasus and a controversial Chechen news site.


Input: APT28 made at least two specific attempts to target the Georgian Ministry of Internal Affairs.


Input: The MIA harbors sensitive information about the inner workings of Georgia's security operations, the country's engagement in multilateral institutions, and the government's communications backbone.


Input: It is responsible for: APT28 made at least two specific attempts to target the MIA.


Input: In one case, we identified an APT28 lure from mid-2013 that referenced MIA-related topics and employed malware that attempted to disguise its activity as legitimate MIA email traffic.

malware

its activity

legitimate MIA email traffic

disguise

as


Input: The lure consisted of a weaponized Excel file that presented a decoy document containing a list of Georgian driver's license numbers.

a weaponized Excel file

a decoy document containing a list of Georgian driver's license numbers

presented


Input: The backdoor attempted to establish a connection to a Georgian MIA mail server and communicate via MIA email addresses ending with'' @mia.ge.gov''.

The backdoor

a connection to a Georgian MIA mail server

MIA email addresses ending with'' @mia.ge.gov''

establish

communicate

via


Input: Once connected to the mail server, APT28's backdoor sent an email message using a subject line related to driver's licenses (in Georgian), and attached a file containing system reconnaissance information.

APT28's backdoor

an email message using a subject line related to driver's licenses (in Georgian)

a file containing system reconnaissance information

sent

attached


Input: This tactic could allow APT28 to obtain data from the MIA's network through a less-monitored route, limiting the MIA network security department's abilities to detect the traffic.

data

the MIA's network

a less-monitored route

the MIA network security department's abilities to detect the traffic

obtain

limiting

from

through


Input: In the second example of MIA targeting, an APT28 lure used an information technology-themed decoy document that included references to the Windows domain'' MIA Users\Ortachala…'' (Figure 1).

an APT28 lure

an information technology-themed decoy document that included references to the Windows domain'' MIA Users\Ortachala…'' (Figure 1)

used


Input: This probably referred to the MIA facility in the Ortachala district of Tbilisi, Georgia's capital city.


Input: The decoy document also contains metadata listing'' MIA'' as the company name and'' Beka Nozadze'' as an author, a possible reference to a system administrator in Tbilisi.

The decoy document

metadata listing'' MIA'' as the company name and'' Beka Nozadze'' as an author

contains


Input: The text of the document purports to provide domain and user group setup information for internal Windows XP and Windows 7 systems.

The text of the document

provide domain and user group setup information for internal Windows XP and Windows 7 systems

purports

to


Input: APT28 possibly crafted this document to appear legitimate to all MIA system users and intended to breach the MIA network specifically using the embedded malware.

this document

appear legitimate to all MIA system users

crafted

to


Input: APT28 also appeared to target Georgia's MOD along with a U.S. defense contractor that was training the Georgian military.


Input: APT28 used a lure document that installed a SOURFACE downloader (further discussed in the Malware section) and contained a listing of birthdays for members of a working group between the Georgian MOD and the U.S. defense contractor.

a lure document

a SOURFACE downloader

a listing of birthdays for members of a working group between the Georgian MOD and the U.S. defense contractor

used

installed

contained


Input: The U.S. contractor was involved in a working group to advise the MOD and Georgian Armed Forces, assess Georgia's military capabilities, and develop a military training program for the country.


Input: We believe that APT28's targeting of the MOD aligns with Russian threat perceptions.


Input: The growing U.S.-Georgian military relationship has been a source of angst for Russia.


Input: Georgia and Russia severed diplomatic relations following the Russia-Georgia War in 2008, and Georgia has since sought to align itself more closely with western security organizations.


Input: Additionally, in June 2014, despite Russia's vocal objections, Georgia, along with Ukraine and Moldova, signed association accords with the EU.


Input: This move placed all three countries more firmly in the EU's political, economic, and security spheres of influence.


Input: Georgian military security issues, particularly with regard to U.S. cooperation and NATO, provide a strong incentive for Russian state-sponsored threat actors to steal information that sheds light on these topics.


Input: Targeting journalists could provide APT28 and its sponsors with a way to monitor public opinion, identify dissidents, spread disinformation, or facilitate further targeting.


Input: Another one of APT28's lures appeared to target a specific journalist covering issues in the Caucasus region.

Another one of APT28's lures

a specific journalist covering issues in the Caucasus region

target


Input: In late 2013, APT28 used a lure that contained a letter addressing a journalist by his first name and claiming to originate from a'' Chief Coordinator'' in Reason Magazine's'' Caucasian Issues Department''-a division that does not appear to exist.

a lure that contained a letter addressing a journalist by his first name and claiming to originate from a'' Chief Coordinator'' in Reason Magazine's'' Caucasian Issues Department''-a division that does not appear to exist

used


Input: (Reason Magazine is a US-based magazine) The letter welcomed the individual as a contributor and requested topic ideas and identification information in order to establish him at the magazine.


Input: In the background, the decoy document installed a SOURFACE backdoor on the victim's system.

the decoy document

a SOURFACE backdoor

the victim's system

installed

on


Input: The body of the letter suggests that APT28 actors are able to read at least two languages–Russian and English.


Input: The grammar of the letter also indicates that English is not the author's first language, despite it purportedly originating from a US-based magazine.


Input: This implies that Russian may be the APT28 author's preferred language.


Input: Targeting journalists could provide APT28 and its sponsors with a way to monitor public opinion, identify dissidents, spread disinformation, or facilitate further targeting.


Input: Several other nation states are suspected of targeting journalists and dissidents to monitor their activity, including China and Iran., Journalists in the Caucasus working on Caucasus independence issues would be a prime target for intelligence collection for Moscow.


Input: Journalists critical of the Kremlin have long been targets of surveillance and harassment, and a number of governments and human rights organizations have publicly criticized the government for its treatment of journalists and its increasing consolidation of control over the media.


Input: We have seen APT28 register at least two domains mimicking the domains of legitimate organizations in the Caucasus, as shown in the table below.

at least two domains mimicking the domains of legitimate organizations in the Caucasus

register


Input: One APT28 domain imitated a key Chechen-focused news website, while the other appeared to target members of the Armenian military by hosting a fake login page.

One APT28 domain

a key Chechen-focused news website

the other

members of the Armenian military

hosting a fake login page

imitated

target

by


Input: Of particular note, the Kavkaz Center is a Chechen-run website designed to present an alternative view to the long-running conflict between Russia and Chechen separatists.


Input: In 2004 and 2013, Russia's Foreign Minister voiced his displeasure that a Swedish company continues to host the Kavkaz Center website.


Input: Eastern European countries' political and military postures are traditionally core Russian government interests.


Input: The Kremlin has long regarded the former Soviet Republics and satellite states as in its sphere of economic, political, and military interest.


Input: Over the past two decades, as many of these states joined NATO and the EU, Russia has attempted to regain its influence in the region.


Input: Many of APT28's targets parallel this continued focus on Eastern European governments and militaries.


Input: We have evidence that APT28 made at least two attempts to compromise Eastern European government organizations: • In a late 2013 incident, a FireEye device deployed at an Eastern European Ministry of Foreign Affairs detected APT28 malware in the client's network.


Input: • More recently, in August 2014 APT28 used a lure (Figure 3) about hostilities surrounding a Malaysia Airlines flight downed in Ukraine in a probable attempt to compromise the Polish government.

a lure (Figure 3) about hostilities surrounding a Malaysia Airlines flight downed in Ukraine

a probable attempt to compromise the Polish government

used

in


Input: A SOURFACE sample employed in the same Malaysia Airlines lure was referenced by a Polish computer security company in a blog post.

A SOURFACE sample

the same Malaysia Airlines lure

employed

in


Input: The Polish security company indicated that the sample was'' sent to the government,'' presumably the Polish government, given the company's location and visibility.


Input: We have evidence that APT28 made at least two attempts to compromise Eastern European government organizations.


Input: APT28 has registered domains similar to those of legitimate Eastern European news sites and governments, listed in Table 2.

domains similar to those of legitimate Eastern European news sites and governments

registered


Input: These domain registrations not only suggest that APT28 is interested in Eastern European political affairs, but also that the group targets Eastern European governments directly.


Input: In addition, APT28 used one domain for command and control sessions (baltichost [.] org) that was themed after the Baltic Host exercises.

one domain for command and control sessions (baltichost [.] org) that was themed after the Baltic Host exercises

used


Input: Baltic Host is a multinational logistics planning exercise, hosted annually since 2009 by one of the three Baltic States (Estonia, Latvia, and Lithuania, all three of which are on Russia's border) on a rotational basis.


Input: In June 2014, this event was integrated with a larger U.S. Army training event, and focused on exercises to improve interoperability with regional allies and partners., This domain registration suggests that APT28 sought to target individuals either participating in the exercises or interested in Baltic military and security matters.


Input: Such targets would potentially provide APT28 with sensitive tactical and strategic intelligence concerning regional military capabilities and relationships.


Input: These exercises are a particular point of interest in Moscow: pro- Kremlin press cited Russia's interpretation of these military exercises and NATO's involvement as a'' sign of aggression,'' and Russia's Foreign Minister publicly stated that the exercise was'' a demonstration of hostile intention.


Input: '' APT28's lures and domain registrations also demonstrate their interest in NATO and other European security organizations.


Input: NATO remains a chief Russian adversary, or in the words of Russia's 2010 military doctrine, a'' main external military danger'' particularly as it moves'' closer to the borders of the Russian Federation.


Input: '' As the traditional western counterweight to the Soviet Union, Russia regards NATO, particularly NATO's eastward expansion, as a threat to Russia's strategic stability.


Input: APT28 also registered a domain name imitating the Organization for Security and Cooperation in Europe (OSCE), an intergovernmental organization that has cited widespread fraud in numerous Russian state elections.


Input: Insider information about NATO, the OSCE and other security organizations would inform Russian political and military policy.


Input: Several of the domains APT28 registered imitated NATO domain names, including those of NATO Special Operations Headquarters and the NATO Future Forces Exhibition.

Several of the domains APT28 registered

NATO domain names

imitated


Input: We also observed a user that we suspect works for NATO HQ submit an APT28 sample to VirusTotal, probably as a result of receiving a suspicious email.


Input: APT28 also demonstrated an interest in defense attaches working in European countries.


Input: We identified an APT28 lure containing a decoy document with a list of British officers and U.S. and Canadian military attachés in London.

an APT28 lure

a decoy document with a list of British officers and U.S. and Canadian military attachés in London

containing


Input: Finally, APT28 used a lure that contained an apparent non-public listing of contact information for defense attachés in the'' Ankara Military Attaché Corps (AMAC),'' which appears to be a professional organization of defense attachés in Turkey.

a lure that contained an apparent non-public listing of contact information for defense attachés in the'' Ankara Military Attaché Corps (AMAC),''

used


Input: In addition to targeting European security organizations and governments, it appears that APT28 is targeting attendees of European defense exhibitions.


Input: Some of the APT28- registered domains imitated those of defense events held in Europe, such as the Farnborough Airshow 2014, EuroNaval 2014, EUROSATORY 2014, and the Counter Terror Expo.

Some of the APT28- registered domains

those of defense events held in Europe

imitated


Input: In September 2014, APT28 registered a domain (smigroup- online.co [.] uk) that appeared to mimic that for the SMi Group, a company that plans events for the'' Defence, Security, Energy, Utilities, Finance and Pharmaceutical sectors.

a domain (smigroup- online.co [.] uk) that appeared to mimic that for the SMi Group

registered


Input: '' Among other events, the SMi Group is currently planning a military satellite communications event for November 2014.


Input: Targeting organizations and professionals involved in these defense events would likely provide APT28 with an opportunity to procure intelligence pertaining to new defense technologies, as well as the victim organizations' operations, communications, and future plans.


Input: APT28 has targeted a variety of organizations that fall outside of the three themes we highlighted above.


Input: However, we are not profiling all of APT28's targets with the same detail because they are not particularly indicative of a specific sponsor's interests.


Input: They do indicate parallel areas of interest to many governments and do not run counter to Russian state interests.


Input: Other probable APT28 targets that we have identified: Our analysis of some of the group's more commonly used tools indicates that APT28 has been systematically updating their malware since 2007.


Input: APT28's tools are suggestive of the group's skills, ambitions, and identity.


Input: Our analysis of some of the group's more commonly used tools indicates that APT28 has been systematically updating their tools since 2007.


Input: APT28 is most likely supported by a group of developers creating tools intended for long-term use and versatility, who make an effort to obfuscate their activity.


Input: This suggests that APT28 receives direct ongoing financial and other resources from a well-established organization, most likely a nation state government.


Input: APT28's malware settings suggest that the developers have done the majority of their work in a Russian language build environment during Russian business hours, which suggests that the Russian government is APT28's sponsor.


Input: Some of APT28's more commonly used tools are the SOURFACE downloader, its second stage backdoor EVILTOSS, and a modular family of implants that we call CHOPSTICK.

Some of APT28's more commonly used tools

the SOURFACE downloader

its second stage backdoor EVILTOSS

a modular family of implants that we call CHOPSTICK

are


Input: • SOURFACE: This downloader is typically called Sofacy within the cyber security community.


Input: However because we have observed the name'' Sofacy'' used to refer to APT28 malware generally (to include the SOURFACE dropper, EVILTOSS, CHOPSTICK, and the credential harvester OLDBAIT), we are using the name SOURFACE to precisely refer to a specific downloader.

the name SOURFACE

a specific downloader

refer

to


Input: This downloader obtains a second-stage backdoor from a C2 server.

This downloader

a second-stage backdoor

a C2 server

obtains

from


Input: CORESHELL is an updated version of SOURFACE.


Input: • EVILTOSS: This backdoor has been delivered through the SOURFACE downloader to gain system access for reconnaissance, monitoring, credential theft, and shellcode execution.

This backdoor

the SOURFACE downloader

system access

reconnaissance

monitoring

credential theft

shellcode execution

been delivered

gain

through

for


Input: • CHOPSTICK: This is a modular implant compiled from a software framework that provides tailored functionality and flexibility.


Input: A number of the malware variants that we profile below, especially the CHOPSTICK family, demonstrate formal coding practices indicative of methodical, diligent programmers.


Input: The modularity of CHOPSTICK alone, with its flexible and lasting platform, demonstrates planning for long-term use and versatility.


Input: We have also noted that APT28 tailors implants to their target environments, configuring them to use local network resources such as email servers.

them

local network resources such as email servers

use


Input: APT28 has attempted to obfuscate their code and implement counter-analysis techniques: • One of the latest samples of CORESHELL includes counter-reverse engineering tactics via unused machine instructions.

their code

counter-analysis techniques

One of the latest samples of CORESHELL

counter-reverse engineering tactics

unused machine instructions

obfuscate

implement

includes

via


Input: This would hinder static analysis of CORESHELL behavior by creating a large amount of unnecessary noise in the disassembly.

This

static analysis of CORESHELL behavior

creating a large amount of unnecessary noise in the disassembly

hinder

by


Input: • A number of CORESHELL droppers also conduct runtime checks, attempting to determine if they are executing in an analysis environment, and if so, they do not trigger their payloads.

A number of CORESHELL droppers

runtime checks

if they are executing in an analysis environment

conduct

determine


Input: • Many samples across the SOURFACE/ CORESHELL, CHOPSTICK, and EVILTOSS malware families obfuscate strings that are decoded at runtime.

Many samples across the SOURFACE/ CORESHELL, CHOPSTICK, and EVILTOSS malware families

strings that are decoded at runtime

obfuscate


Input: Two of the malware families (SOURFACE/CORESHELL and EVILTOSS) use the same decryption sequence and similar algorithms for string encoding and decoding.

Two of the malware families (SOURFACE/CORESHELL and EVILTOSS)

the same decryption sequence and similar algorithms

string encoding and decoding

use

for


Input: These families encode their strings at compile time using a custom stream cipher.

These families

their strings

compile time

a custom stream cipher

encode

at

using


Input: From a high level, these ciphers share a similar design across the malware families but differ slightly in the internal arithmetic operations.


Input: • APT28 has employed RSA encryption to protect files and stolen information moved from the victim's network to the controller.

RSA encryption

protect files and stolen information moved from the victim's network to the controller

employed

to


Input: APT28 has made incremental and systematic changes to the SOURFACE downloader and its surrounding ecosystem since as early as 2007.


Input: These changes indicate a long-standing and dedicated development effort behind APT28.


Input: We have observed samples of the SOURFACE downloader compiled between 2007 and 2014.


Input: We call SOURFACE (samples are frequently named netids.dll) a first stage downloader because its primary job is to retrieve a second stage payload from a C2 server.

SOURFACE

a second stage payload

a C2 server

retrieve

from


Input: Until 2013, the SOURFACE downloader used hard-coded IP addresses for C2 communications, whereas the future CORESHELL samples use domains.

the SOURFACE downloader

hard-coded IP addresses

C2 communications

the future CORESHELL samples

domains

used

use

for


Input: First, a malware family is a collection of malware in which each sample shares a significant amount of code with all of the others.


Input: There are exceptions: for example, some files contain public and standard code libraries that we do not take into consideration when making a family determination.


Input: A malware ecosystem is a group of malware families that work together to perform the same objective.


Input: Perhaps the simplest and most typical ecosystem is a dropper and a backdoor that are used together.


Input: They may not share the same code structure, but they are related because one drops and installs the other.

one

the other

drops and installs


Input: The ecosystem surrounding the SOURFACE downloader frequently consists of a dropper, which installs SOURFACE.

a dropper

SOURFACE

installs


Input: The SOURFACE downloader then receives another dropper from its C2 server, and this second dropper installs a second stage backdoor, which is usually EVILTOSS.

The SOURFACE downloader

another dropper

its C2 server

this second dropper

a second stage backdoor

receives

installs

from


Input: In April 2013, based on compile time, the group began to make significant alterations to the SOURFACE downloader.


Input: They started by changing the compiled DLL name to'' coreshell.dll'' and making minor changes to the network communications, as seen in Figure 7.


Input: The hostname, volume serial number and OS version data are encoded in the new URL format.


Input: As seen in the table below, the SOURFACE/ CORESHELL developers also made other modifications that changed the exported function name and file size over time.


Input: In April 2013, based on compile time, the group began to make significant alterations to the SOURFACE downloader.


Input: Variants of the SOURFACE second stage backdoor, EVILTOSS, share some code similarities with SOURFACE.


Input: However, it contains more capabilities, including the ability to provide access to the file system and registry, enumerate network resources, create processes, log keystrokes, access stored credentials, and execute shellcode.

it

access to the file system and registry

network resources

processes

keystrokes

stored credentials

shellcode

provide

enumerate

create

log

access

execute


Input: The backdoor encrypts data that it uploads with an RSA public key.

The backdoor

data

it

an RSA public key

encrypts

uploads

with


Input: Many of its variants we have seen are named netui.dll.


Input: EVILTOSS variants may use the Simple Mail Transfer Protocol (SMTP) to send stolen data in an attachment named'' detaluri. dat''.

EVILTOSS variants

the Simple Mail Transfer Protocol (SMTP)

send stolen data in an attachment named'' detaluri. dat''

use

to


Input: The backdoor attaches this file to a preformatted email and sends it out through a victim's mail server.

The backdoor

this file

a preformatted email

it

a victim's mail server

attaches

sends

to

out

through


Input: Interestingly, we found an antivirus report from 2004 detailing what appears to be an early variant of EVILTOSS.


Input: The backdoor was installed alongside the NATO-themed decoy document depicted in Figure 8.

The backdoor

the NATO-themed decoy document depicted in Figure 8

was installed

alongside


Input: The backdoor sent data via SMTP to natosmtp @mail [.] ru and received its tasking via POP from natopop @mail [.] ru.

The backdoor

data

SMTP

natosmtp @mail [.] ru

its tasking

POP

natopop @mail [.] ru

sent

received

via

to

via

from


Input: Although we have not conclusively attributed this sample to APT28, it does suggest the possibility that APT28 has been operating since as early as 2004.


Input: A modular development framework suggests the group has had an organized development effort since as early as 2007.


Input: During our research, we discovered that APT28 uses a backdoor developed using a modular framework.

a backdoor developed using a modular framework

uses


Input: We call this backdoor CHOPSTICK, a somewhat ironic name that comes from our semi-random name generator.


Input: The modular design allows flexible options for compiling variants with different capabilities as needed, as well as deploying additional capabilities at runtime.


Input: This allows the developers to make targeted implants, including only the capabilities and protocols necessary for a specific environment.


Input: Such a modular framework suggests the group has had an organized development effort since as early as 2007.


Input: A formal development environment, in which code is versioned and well-organized, would almost certainly be required to track and define the various modules that can be included in the backdoor at compile time.


Input: CHOPSTICK variants may move messages and information using at least three methods: 1.


Input: Communications with a C2 server using HTTP.

Communications with a C2 server

HTTP

using


Input: These protocols are covered in more detail in Appendix D. 2.


Input: Email sent through a specified mail server.

Email

a specified mail server

sent

through


Input: One CHOPSTICK v1 variant contained modules and functions for collecting keystroke logs, Microsoft Office documents, and PGP files.

One CHOPSTICK v1 variant

keystroke logs

Microsoft Office documents

PGP files

collecting


Input: The monitoring for new files of interest is performed by a'' Directory Observer'' module.

The monitoring for new files of interest

a'' Directory Observer'' module

is performed


Input: In one sample this information was intended to be sent via SMTP using a Georgian MIA mail server.

this information

SMTP

a Georgian MIA mail server

be sent

via

using


Input: It used one of four embedded sender email addresses (@mia.gov.ge) to send files via email to another email address on the same mail server.

It

one of four embedded sender email addresses (@mia.gov.ge)

send files via email to another email address on the same mail server

used

to


Input: All information required for the email was hardcoded in the backdoor.


Input: Local copying to defeat closed networks.


Input: One variant of CHOPSTICK focuses on apparent air gap/closed network capabilities by routing messages between local directories, the registry and USB drives.

One variant of CHOPSTICK

messages

local directories, the registry and USB drives

routing

between


Input: During our research into APT28's malware, we noted two details consistent across malware samples.


Input: The first was that APT28 had consistently compiled Russian language settings into their malware.


Input: The second was that malware compile times from 2007 to 2014 corresponded to normal business hours in the UTC + 4 time zone, which includes major Russian cities such as Moscow and St. Petersburg.


Input: PE resources include language information that can be helpful if a developer wants to show user interface items in a specific language.


Input: Non-default language settings packaged with PE resources are dependent on the developer's build environment.


Input: Each PE resource includes a'' locale'' identifier with a language ID'' composed of a primary language identifier indicating the language and a sublanguage identifier indicating the country/region.


Input: '' At the time of the writing of this paper, we had identified 103 malware samples that were both attributed to APT28 and contained PE resources.


Input: Table 5 shows the locale identifiers with associated language and country/region for these samples.


Input: The samples with Russian language settings were compiled between late 2007 and late 2013, as depicted in Figure 9.


Input: This consistency over a long timeframe suggests that the developers of APT28 malware were using a build environment with Russian language settings at least some of the time and made no effort to obscure this detail.


Input: Overall, the locale IDs suggest that APT28 developers can operate in both Russian and English.


Input: Of the 140 malware samples that we have attributed to APT28 so far, over 89% were compiled between 0400 and 1400 UTC time, as depicted in Figure 10.


Input: Over 96% were compiled between Monday and Friday.


Input: This parallels the working hours in UTC+0400 (that is, compile times begin about 8AM and end about 6PM in this time zone).


Input: This time zone includes major Russian cities such as Moscow and St. Petersburg.


Input: We started researching APT28 based on activity we observed on our clients' networks, similar to other targeted threat groups we have identified over time.


Input: We assess that APT28 is most likely sponsored by the Russian government.


Input: We summarize our key observations about APT28 in Figure 11 below.


Input: APT28's characteristics-their targeting, malware, language, and working hours-have led us to conclude that we are tracking a focused, long- standing espionage effort.


Input: Given the available data, we assess that APT28's work is sponsored by the Russian government.


Input: We use the term'' threat group'' to refer to actors who work together to target and penetrate networks of interest.


Input: These individuals may share the same set of tasks, coordinate targets, and share tools and methodology.


Input: They work together to gain access to their targets and steal data.

They

access to their targets

data

gain

steal


Input: The art of attributing disparate intrusion activities to the same threat group is not always simple.


Input: Different groups may use similar intrusion methodologies and common tools, particularly those that are widely available on the Internet, such as pwdump, HTran, or Gh0st RAT.


Input: There may be overlaps between groups caused by the sharing of malware or exploits they have authored, or even the sharing of personnel.


Input: Individual threat actors may move between groups either temporarily or permanently.


Input: A threat actor may also be a private citizen who is hired by multiple groups.


Input: Multiple groups, on occasion, compromise the same target within the same timeframe.


Input: Distinguishing one threat group from another is possible with enough information, analytical experience, and tools to piece it all together.


Input: We can analyze multiple incidents and tell by the evidence left behind that a given incident was the result of one threat group and not another.


Input: Threat actors leave behind various forensic details.


Input: They may send spear phishing emails from a specific IP address or email address.

They

spear phishing emails

a specific IP address or email address

send

from


Input: Their emails may contain certain patterns; files have specific names, MD5 hashes, timestamps, custom functions, and encryption algorithms.


Input: Their backdoors may have command and control IP addresses or domain names embedded.


Input: These are just a few examples of the myriad of forensic details that we consider when distinguishing one threat group from another.


Input: At the most basic level, we say that two intrusion events are attributed to the same group when we have collected enough indicators to show beyond a reasonable doubt that the same actor or group of actors were involved.


Input: We track all of the indicators and significant linkages associated with identified threat groups in a proprietary database that comprises millions of nodes and linkages between them.


Input: In this way, we can always go back and answer'' why'' we associated cyber threat activity with a particular group.


Input: SOURFACE is a downloader that obtains a second stage backdoor from a C2 server.

SOURFACE

a downloader

a second stage backdoor

a C2 server

is

obtains

from


Input: Over time the downloader has evolved and the newer versions, usually compiled with the DLL name'coreshell.dll', are distinct enough from the older versions that we refer to it as SOURFACE/CORESHELL or simply CORESHELL.


Input: This appendix focuses on these newer versions.


Input: CORESHELL uses two threads to communicate with its C2 server.

CORESHELL

two threads

communicate with its C2 server

uses

to


Input: The first thread sends beacons that contain the process listing of the compromised host.

The first thread

beacons that contain the process listing of the compromised host

sends


Input: The second thread is responsible for downloading and executing stage two payloads.

The second thread

stage two payloads

downloading

executing


Input: Messages are sent using HTTP POST requests whose bodies contain encrypted and Base64 encoded data.

Messages

HTTP POST requests

encrypted and Base64 encoded data

are sent

contain

using


Input: The encryption algorithm is a custom stream cipher using a six-byte key.


Input: Commands from the controller to the CORESHELL implant are encrypted using another stream cipher but this time using an eight-byte key.

Commands from the controller to the CORESHELL implant

another stream cipher but this time using an eight-byte key

are encrypted

using


Input: CORESHELL has used the same user agent string ('' MSIE 8.0'') that SOURFACE previously used, but in more recent samples CORESHELL uses the default Internet Explorer user agent string obtained from the system.


Input: Figure 11 shows an example POST request.


Input: When Base64 decoded, the POST content looks like this: The key used to encrypt the message is six bytes long and is appended to the end of the message.


Input: In this is example the key would be: 30 ac e5 21 e4 a6.


Input: When the message is decrypted, the resulting plaintext is: The following table contains a breakdown of each of the field's C2 message.


Input: Commands are sent from the C2 server to the CORESHELL backdoor in HTTP responses to the POST requests.

Commands

the C2 server

the CORESHELL backdoor

HTTP responses to the POST requests

are sent

from

to

in


Input: The command is identified by the NULL terminated UNICODE string'' OK'' (O\x00\K\x00\x00\ x00).


Input: The command is Base64 encoded and immediately follows the'' OK'' string.


Input: Figure 12 shows a sample CORESHELL command: The Base64 decoded string is: The following table contains a description of each field in the command message: When the above command'' 10 41 70 41 10 42 33…'' is decrypted using the key'' 01 01 01 01 01 01 01 01'' the following command message is produced: The implant supports the following four command identifiers from the controller as seen in Table 8.


Input: The first byte of the command message specifies the command type and is immediately followed by the PE or shellcode to be executed.


Input: In this example the command byte is 04 indicating the following bytes are shellcode.


Input: If the command byte was 01, 02, or 03 the following bytes would be a DLL or EXE that would be written to disk and executed.

a DLL or EXE

disk

be written

executed

to


Input: CHOPSTICK is a backdoor that uses a modularized, object-oriented framework written in C++.

CHOPSTICK

a backdoor

is


Input: This framework allows for a diverse set of capabilities across malware variants sharing a common code base.


Input: CHOPSTICK may communicate with external servers using SMTP or HTTP.

CHOPSTICK

external servers

SMTP or HTTP

communicate

with

using


Input: This appendix documents variants using HTTP communications.


Input: The first time CHOPSTICK is executed, it may encrypt and store configuration data in the Registry key HKU\S-1-5-19Classes\Software\Microsoft\MediaPlayer\ {E6696105-E63E-4EF1-939E- 15DDD83B669A} \chnnl.

it

configuration data

the Registry key HKU\S-1-5-19Classes\Software\Microsoft\MediaPlayer\ {E6696105-E63E-4EF1-939E- 15DDD83B669A} \chnnl

encrypt and store

in


Input: The user HKU\S-1-5-19 corresponds to the LOCALSERVICE account SID.


Input: The configuration block is encrypted using RC4 encryption.

The configuration block

RC4 encryption

is encrypted

using


Input: The key is a combination of a 50-byte static key and a four-byte salt value randomly generated at runtime.


Input: The static key is derived from opcodes in the backdoor.


Input: CHOPSTICK collects detailed information from the host including the Windows version, CPU architecture, Windows Firewall state, User Account Control (UAC) configuration settings on Windows Vista and above and Internet Explorer settings.

CHOPSTICK

detailed information

the host

the Windows version

CPU architecture

Windows Firewall state

User Account Control (UAC) configuration settings on Windows Vista and above

Internet Explorer settings

collects

from


Input: It also tests for the installation of specific security products (Table 9) and applications (Table 10).

It

the installation of specific security products (Table 9) and applications (Table 10)

tests

for


Input: After collecting host information, CHOPSTICK creates a hidden file that may be named% ALLUSERSPROFILE% \edg6EF885E2.tmp for temporary storage and creates a Windows mailslot with the name'' checkmesv5555''.

collecting

creates

creates

host information

CHOPSTICK

a hidden file that may be named% ALLUSERSPROFILE% \edg6EF885E2.tmp

temporary storage

a Windows mailslot

the name'' checkmesv5555''

for

with


Input: Its usage of a Windows mailslot would potentially allow external binaries to write data to the'' checkmesv5555'' mailslot, possibly allowing CHOPSTICK to encrypt and store output from other malware.

external binaries

data

the'' checkmesv5555'' mailslot

CHOPSTICK

output from other malware

write

encrypt

to


Input: It creates a thread that records user activity on the host, capturing desktop screenshots in JPEG format, tracks current window focus, collects keystrokes, and scrapes window contents (text, context menus, etc.).

It

a thread

user activity on the host

desktop screenshots

JPEG format

current window focus

keystrokes

window contents (text, context menus, etc.)

creates

records

capturing

tracks

collects

scrapes

in


Input: User activity is captured once every 500 milliseconds and logged in an HTML-like format.

User activity

once

500 milliseconds

an HTML-like format

is captured

logged

every

in


Input: The thread writes user activity log messages to the'' checkmesv5555'' mailslot in plain text.

The thread

user activity log messages

the'' checkmesv5555'' mailslot

plain text

writes

to

in


Input: CHOPSTICK reads messages from the mailslot, encrypts them using RC4, and then stores the encrypted message in an edg6EF885E2.tmp temporary file.

CHOPSTICK

messages

the mailslot

them

the encrypted message

an edg6EF885E2.tmp temporary file

reads

encrypts

stores

from

using

in


Input: The RC4 encryption used here also uses a 50- byte static key plus four-byte random salt value.


Input: After approximately 60 seconds of execution time, CHOPSTICK begins communicating with one of its C2 servers over HTTP.

CHOPSTICK

one of its C2 servers

HTTP

communicating

with

over


Input: After sending an initial HTTP GET request it uploads the file contents of edg6EF885E2. tmp to the C2 server using HTTP POST requests.

sending

uploads

an initial HTTP GET request

it

the file contents of edg6EF885E2. tmp

the C2 server

HTTP POST requests

to

using


Input: It does not wait for a response from the server to begin uploading.


Input: Once the contents of edg6EF885E2.tmp are uploaded, CHOPSTICK deletes the file.

the contents of edg6EF885E2.tmp

CHOPSTICK

the file

are uploaded

deletes


Input: Figure 13 below contains an example of an HTTP POST request uploading a segment from edg6EF885E2.tmp.

an HTTP POST request

a segment from edg6EF885E2.tmp

uploading


Input: CHOPSTICK uses a URL-safe Base64 encoding, using an alphabet that substitutes'' +'' and''/'' for''-'' and'''', respectively.

CHOPSTICK

a URL-safe Base64 encoding

an alphabet that substitutes'' +'' and''/'' for''-'' and'''', respectively

uses

using


Input: Each HTTP request contains multiple Base64 encoded URL parameters, however only one parameter contains information encoded by the malware ('' ai='') and the rest of the URL parameters appear to be randomly generated per request.


Input: CHOPSTICK encrypts an 11-byte sequence in the'' ai='' parameter.

CHOPSTICK

an 11-byte sequence

the'' ai='' parameter

encrypts

in


Input: The purpose of this parameter appears to be to uniquely identify the particular instance of the backdoor to the C2 server.

identify

the particular instance of the backdoor

the C2 server

to


Input: The Base64 encoded text of this parameter begins with a number of randomly generated alphabetical characters presumably intended to prevent people from Base64 decoding the whole string without some knowledge of how the malware family works.


Input: The first four bytes of the message are an XOR key for the remainder of the data.


Input: Once decrypted using the XOR key, an 11-byte sequence is revealed.


Input: The first seven bytes are static, and are hard-coded in CHOPSTICK, while the last four bytes appear to be unique.


Input: The message body of the POST request is also Base64 encoded.

The message body of the POST request

is also Base64 encoded


Input: This encoded string is also prefixed with random characters designed to break the output of a Base64 decode operation on the entire string.


Input: The first 15 bytes of the decoded message body comprise another 11-byte sequence similar to the sequence stored in the'' ai='' parameter as described above.


Input: Decrypting these bytes yields another static seven-byte sequence, followed by four unique bytes.


Input: The remainder of the message body consists of the RC4 encrypted data containing the HTML-formatted user activity log, edg6EF885E2.tmp.


Input: After uploading edg6EF885E2.tmp, CHOPSTICK continues to query its C2 servers for commands using HTTP GET requests.

uploading

query

CHOPSTICK

its C2 servers

commands

HTTP GET requests

for

using


Input: The malware contains code which allows it to load or memory-map external modules that export the following functions: SendRawPacket, GetRawPacket, InitializeExp, DestroyExp, IsActiveChannel, GetChannelInfo, SetChannelInfo, Run, GetModuleInfo, GiveMessage, and TakeMessage.

it

external modules that export the following functions: SendRawPacket, GetRawPacket, InitializeExp, DestroyExp, IsActiveChannel, GetChannelInfo, SetChannelInfo, Run, GetModuleInfo, GiveMessage, and TakeMessage

load

memory-map


Input: CHOPSTICK backdoors are compiled within a modularized development framework.


Input: This means that two separate CHOPSTICK backdoors may contain vastly different functionality, depending on which modules were included at compile time.


Input: The modules that are included in an instance of CHOPSTICK may be reported to the C2 server as part of POST messages.

The modules that are included in an instance of CHOPSTICK

the C2 server

part of POST messages

be reported

to

as


Input: Figure 14 includes an example from a CHOPSTICK v1 variant: To decode the POST content, the first step is to remove characters from the Base64 string (the number of characters to remove may vary between different communication channels).


Input: In the example from Figure 14, the number of characters removed is seven.


Input: Once these characters are removed the decoded (but still encrypted) text looks like this: The first two words ('' 72 11'' and'' fd 22'') are checksums that are used to validate the message.

The first two words ('' 72 11'' and'' fd 22'')

the message

validate


Input: The next 4 bytes'' f8 dc 33 9e'' are a salt value that is appended to the end of an RC4 key.


Input: Once decrypted, the message looks like the following: The strings'' V4MGNxZWlvcmhjOG9yZQ'' and'' = < < \xee'' are hardcoded in the implant.


Input: The module information starts at offset 0x20 with the string'' 01 00 00'' and is formatted as follows: The modules included in this CHOPSTICK v1 implant are: Our determination of a CHOPSTICK'' v1'' versus'' v2'' is based on the self-identification of the kernel ID and associated modules.


Input: Compare the list of CHOPSTICK v1 modules in Table 12 with the list of modules in an example CHOPSTICK v2 variant in Table 13: The kernel IDs 0x0001 and 0x0002 indicate different versions.


Input: The corresponding modules in each backdoor also are consistently identified with 0x01 and 0x02, respectively, in the second byte.


Input: In both variants the modules with keystroke log, file system access, and command shell capabilities have the consistent identifiers 0x10, 0x11, and 0x13, respectively, in the first byte.


Input: This suggests that the first byte in the module ID identifies the module type whereas the second byte identifies the kernel version.


Input: The kernel sends commands to each module using its module ID.


Input: The commands that each module understands are likely consistent from build to build.


Input: Table 14 and Table 15 show examples of commands that each module understands.


Input: OLDBAIT is a credential harvester that installs itself in% ALLUSERPROFILE% \\Application Data\ Microsoft\MediaPlayer\updatewindws.exe.

OLDBAIT

a credential harvester

itself

% ALLUSERPROFILE% \\Application Data\ Microsoft\MediaPlayer\updatewindws.exe

is

installs

in


Input: There is a missing space in the MediaPlayer directory and the filename is missing the'o' character.


Input: Both the internal strings and logic are obfuscated and are unpacked at startup.

Both the internal strings and logic

are obfuscated


Input: Credentials for the following applications are collected: Both email and HTTP can be used to send out the collected credentials.

Credentials for the following applications

email

HTTP

send out the collected credentials

are collected

be used

to


Input: Sample HTTP traffic is displayed in Figure 15.


Input: OLDBAIT handles APIs very similarly to SOURFACE and EVILTOSS.


Input: There is a setup routine that loads the imports into a table and all API calls reference an index to this table.


Input: In SOURFACE and EVILTOSS the table is stored in a global variable while in OLDBAIT this table is allocated at runtime and a pointer is passed between functions.


Input: Cyber espionage has been a hot topic through the last years.


Input: Computer attacks known as'' APT'' (Advanced Persistent Threat) have become widely reported and emphasized by the media, damages are now considered as real and strategic trends are moving in cyber defense.


Input: AIRBUS Defence & Space–CyberSecurity unit responds to such attacks for its customers every day, developing a complete range of solutions.


Input: Today, we decided to release publicly information on a specific group of APT attackers known as'' Pitty Tiger''.


Input: This information comes directly from investigations led by our Threat Intelligence.


Input: Pitty Tiger is a group of attackers that have been active since at least 2011.


Input: They have targeted private companies in several sectors, such as defense and telecommunications, but also at least one government.


Input: We have been able to track down this group of attackers and can provide detailed information about them.


Input: We were able to collect and reveal their'' malware arsenal''.


Input: We also analyzed their technical organization.


Input: Our investigations indicate that Pitty Tiger has not used any 0day vulnerability so far, rather they prefer using custom malware, developed for the group's exclusive usage.


Input: Our discoveries indicate that Pitty Tiger is a group of attackers with the ability to stay under the radar, yet still not as mature as other groups of attackers we monitor.


Input: Pitty Tiger is probably not a state-sponsored group of attackers.


Input: They lack the experience and financial support that one would expect from state-sponsored attackers.


Input: We suppose this group is opportunistic and sells its services to probable competitors of their targets in the private sector.


Input: We have been able to leverage several attackers profiles, showing that the Pitty Tiger group is fairly small compared to other APT groups, which is probably why we saw them work on a very limited amount of targets.


Input: At the end of this report, we provide indicators of compromise to help people detect current Pitty Tiger attacks.


Input: APT attacks follow what we call the'' APT kill chain''.


Input: The kill chain describes briefly the way attackers do perform their actions.


Input: It can be summarized by the following scheme: The reconnaissance phase commences when an attacker selects a new target and involves the acquisition of information about that target.


Input: There is very little information available about this phase, and there is little data about it.


Input: The only way to collect information about this phase would be to already monitor all attackers' actions at this step, which is hardly feasible.


Input: The longer the attackers spend time in attempting to understand their target and its online presence, the easier it will be to find efficient ways to penetrate that company's systems.


Input: This reconnaissance phase is both about finding information to break into the targeted network successfully and about searching for data which could help to accelerate sensitive information isolation (like the name of a key employee for example).


Input: This phase mostly relies on open sources from the Internet: social networks, press releases, white papers, corporate websites, search engines, but also on some active tools like vulnerability scanners etc.


Input: At this stage, the APT attackers have a solid knowledge of their target and its key employees.


Input: The attackers have everything they need to start looking for an entry point to the company's network and establish one or several permanent backdoors into the environment.

The attackers

one or several permanent backdoors

the environment

establish

into


Input: The attackers mostly rely on two techniques here to infect one or several computers, usually workstations, inside the target's network: spear phishing and drive-by downloads.

The attackers

spear phishing and drive-by downloads

rely

on


Input: Spear phishing can be described as targeted e-mail phishing.

Spear phishing

targeted e-mail phishing

be described

as


Input: In a spear phishing scheme, attackers send very few e-mails to targeted people.

In

to

a spear phishing scheme

attackers

very few e-mails

targeted people

send


Input: In fact, they can even send just a single e-mail.


Input: The trick is to target the right victim and provide it with the right content, so that they will click on a link leading to drive-by download of a malware, or open an attached file which will infect their computer.

target

provide

click

open

the right victim

it

the right content

they

a link leading to drive-by download of a malware

an attached file which will infect their computer

with

on


Input: Some groups of attackers also use'' watering hole'' techniques to successfully compromise their targets.

Some groups of attackers

'' watering hole'' techniques

successfully compromise their targets

use

to


Input: To build a watering hole attack, attackers do compromise the website of a third party, generally a supplier of the target, which is typically visited by a specific group of professionals and very likely by the target.

To

build a watering hole attack

attackers

the website of a third party, generally a supplier of the target, which is typically visited by a specific group of professionals and very likely by the target

compromise


Input: Every visitor of the compromised third party is then infected.

Every visitor of the compromised third party

is then infected


Input: The method has one major drawback: it will also infect third parties who visit the website.


Input: Attackers have developed ways to avoid this.


Input: If their reconnaissance phase has been done effectively, they already know all IP ranges used by the target company.


Input: It just takes a few lines of code in the infecting script to only compromise visitors coming from the target IP ranges.

compromise

visitors coming from the target IP ranges


Input: Direct attacks against servers of the target can also be a way to penetrate the target's network.


Input: Attackers have gained access to one or several machines inside the target's corporate network.

Attackers

access to one or several machines inside the target's corporate network

gained


Input: They need to install several different backdoors in order to be able to always access the network.

They

several different backdoors

be able to always access the network

install

in order to


Input: In case one backdoor falls, there will be others.


Input: As soon as the attackers are sure they have enough access, they start looking for two things: intellectual property (or anything else they want to know or steal) in alignment with predefined mission objectives, and a means of privilege escalation to facilitate lateral movement within the compromised environment.

they

intellectual property (or anything else they want to know or steal) in alignment with predefined mission objectives

a means of privilege escalation to facilitate lateral movement within the compromised environment

looking

for


Input: It generally does not take long before the attackers gain domain administrator privileges and dump all the Active Directory content.

the attackers

domain administrator privileges

all the Active Directory content

gain

dump


Input: They use lateral moves between machines inside the network, and look for everything they need.


Input: This step is very hard to detect, since they only use valid credentials and legitimate administration tools such as PsExec.


Input: Data exfiltration is the last step before the attackers loop to the lateral moves step, in a never-ending circle of prolonged access and information theft.

Data exfiltration

the last step

is