Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/28/2019
02:30 PM
50%
50%

Fancy Bear Dons Plain Clothes to Try to Defeat Machine Learning

An analysis of a sample published by the US government shows Russian espionage group APT28, also known as Fancy Bear, has stripped down its initial infector in an attempt to defeat ML-based defenses.

The APT28 cyber-espionage group, often called "Fancy Bear" and linked to Russia, has stripped much of the malicious functionality from its initial infector, hiding it in a sea of benign code, according to an analysis published today by Cylance, a subsidiary of Blackberry.

The approach shows that the group has developed greater operational sophistication, says Josh Lemos, vice president of research and intelligence at Cylance (and no relation to the author). The authors of the implant appear to be trying to hide in plain site by using well-known libraries, such as OpenSSL, and a widely used compiler, POCO C++, resulting in 99% of the more than 3 megabytes of code being classified as benign, according to Cylance's analysis.

Those steps, taken along with other newly adopted tactics, suggest the group is trying a different approach to dodge evolving defenses, Lemos says.

"It would be odd for them to shift tactics without a reason," he says. "That is what is giving us the belief that this is a response to a lot of players in the industry having shifted to static ML and even the heuristics engines and traditional AV scanners — those are going to have challenges keying in on malicious bits of this code."

Attackers have used a variety of ways to dodge host-based defenses in the past, most often involving encrypting, or "packing," parts of the file to prevent antivirus (AV) scanners from recognizing the malicious parts of the code. In addition, attackers have used domain generation algorithms (DGAs) to download code at a later date from hard-to-predict locations, defeating initial scans that look for malicious code, the report says.

Camouflaging malware as legitimate code is old hat for cybercriminals. Deception is a key part of their toolkits. Attempting to deceive machine-learning (ML) algorithms designed to spot malicious code features is more difficult.

"Machine learning is going to look at the static code and say, 'Almost all of this is good code,'" Lemos says. "That may bias [the algorithm] toward labeling it 'good' in the machine-learning decision."

APT28 has operated since at least 2007, according to an initial 2014 analysis by FireEye. The group has largely not focused on intellectual property theft, as some Chinese APT groups do, but instead steals government secrets, the company says in its report.

"Since at least 2007, APT28 has been targeting privileged information related to governments, militaries and security organizations that would likely benefit the Russian government," the analysis states. "APT28 has systematically evolved its malware since 2007, using flexible and lasting platforms indicative of plans for long-term use and sophisticated coding practices that suggest an interest in complicating reverse engineering efforts."

The US Cyber Command (USCYBERCOM) submitted the sample for the implant in May to the VirusTotal scanning service, which is run by Google. The action is part of an initiative, which started in November 2018, where the agency issues a sample to VirusTotal and then sends a tweet directing analysts to the sample. The initiative essentially notifies the industry of significant threats and results in a great deal of crowdsourced research into the code.

Almost all of the malware submitted to VirusTotal came from Russian-linked operations, according to security experts. The notable exceptions: On July 3, the cybersecurity agency warned that a group — identified as Iranian by security firms — was using an Outlook vulnerability to exploit targets.

Cylance is the latest security firm to take a look at the tools used by the Russian cyber-espionage group, which is blamed for cyberattacks on the nation of Georgia prior to Russia's 2008 invasion, and for compromising computers at the US Democratic National Committee to steal e-mails and other sensitive data prior to the 2016 presidential election

In 2019, for example, security firm ESET published an analysis of the Zebrocy malware, one of the payloads of the APT28/Fancy Bear group, which had more than 30 commands that could be used for network and system reconnaissance. Unlike Cylance, ESET used active telemetry to gain insight into what the malware did once it was on a system.

While the latest techniques could cause problems for detection approaches based on machine-learning and heuristics, active approaches — such as watching for malicious behavior — are less likely to be fooled, Cylance's Lemos says.

"Looking at code in multiple ways — that is very purposeful," he says. "It does take a very blended approach for good defense these days."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Right to Be Patched: How Sentient Robots Will Change InfoSec Management."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...