Attacks/Breaches

12/21/2017
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russia's Fancy Bear APT Group Gets More Dangerous

Encryption and code refreshes to group's main attack tool have made it stealthier and harder to stop, ESET says.

Fancy Bear, the Russian advanced persistent threat group associated with the infamous intrusion at the Democratic National Committee last year among numerous other break-ins, may have become just a little bit more dangerous.

The group — also referred to as Sednit, APT28, and Sofacy — appears to have recently refurbished its primary malware tool, Xagent, and added new functionality to make it decidedly stealthier and harder to stop, security vendor ESET said in an advisory Thursday.

The modular backdoor has been a central component of Fancy Bear's campaigns for several years. Initial versions of the tool were designed to break into Windows and Linux systems. But it has been updated in the past two years to include support for iOS, Android, and, since the beginning of this year, OS X.

The fourth and latest version of the malware comes with new techniques for obfuscating strings and all run-time type information. The techniques, according to ESET, have significantly improved the malware's encryption abilities. The Fancy Bear/Sednit group also has upgraded some of the code used for command and control (C&C) purposes and added a new domain generation algorithm (DGA) feature for quickly creating fallback C&C domains.

"The previous version of Xagent modular backdoor was already very complex, but the new version is even more," says Thomas Dupuy, malware researcher at ESET.

ESET is still completing its analysis of the new features in Xagent, but the new encryption algorithm and DGA implementation are significant, he says. "The former makes the malware analysis more difficult while the latter makes domain takeover more challenging, as there are more domains to take down or seize," Dupuy says.

In addition to the encryption and DGA, Fancy Bear also has some internal improvements such as new commands that can be used for hiding malware configuration data and other data on a target system. The authors of the malware have redesigned and refactored some existing components so it has become harder to recognize previously discovered mechanisms. Xagent also now has the ability to take screenshots of the target's desktop.

The new version of Xagent has improved Fancy Bear/Sednit's ability to stay under the radar, Dupuy says. "Some of these changes are definitely related to the fact that they are trying to avoid too much attention while others are to make security researchers' jobs harder," he notes.

Otherwise, Fancy Bear/Sednit's tactics and techniques have remained largely unchanged. The group still relies heavily on the use of very cleverly crafted phishing emails to try and get targets to click on links that lead to malicious domains or to download malware.

It has largely stopped using Sedkit, an exploit kit used in numerous previous attacks, and has increasingly begun using a platform called DealersChoice to initially breach systems.

DealersChoice, according to ESET, can generate documents with embedded Adobe Flash Player exploits. One version of the platform is designed to first check which version of Flash Player a target system might be running and then exploit it. Another variant first contacts a C&C server and then deliver a selected Flash exploit.

Like the previous Sedkit exploit kit, DealersChoice is designed to scour international news stories and include references to relevant ones in the malicious emails it generates and sends to potential targets.

From a targeting standpoint, Fancy Bear/Sednit still appears to be focused on the same objectives, Dupuy says. It's still attacking government departments and embassies all over the world, with a particular interest in Eastern Europe, where the group regularly targets individuals and organizations involved in geopolitics.

Generally, Fancy Bear's tactics, techniques, and procedures have not changed a whole lot, Dupuy says. But the group has shown a tendency to vary its infection techniques, he adds. "The new version is more complex to analyze, which slows down ability to defend against the malware," he notes.

Related content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12959
PUBLISHED: 2018-07-19
The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all contract balances into their account).
CVE-2018-14336
PUBLISHED: 2018-07-19
TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses.
CVE-2018-10620
PUBLISHED: 2018-07-19
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code t...
CVE-2018-14423
PUBLISHED: 2018-07-19
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
CVE-2018-3857
PUBLISHED: 2018-07-19
An exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain...