Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/28/2019
02:30 PM
50%
50%

Fancy Bear Dons Plain Clothes to Try to Defeat Machine Learning

An analysis of a sample published by the US government shows Russian espionage group APT28, also known as Fancy Bear, has stripped down its initial infector in an attempt to defeat ML-based defenses.

The APT28 cyber-espionage group, often called "Fancy Bear" and linked to Russia, has stripped much of the malicious functionality from its initial infector, hiding it in a sea of benign code, according to an analysis published today by Cylance, a subsidiary of Blackberry.

The approach shows that the group has developed greater operational sophistication, says Josh Lemos, vice president of research and intelligence at Cylance (and no relation to the author). The authors of the implant appear to be trying to hide in plain site by using well-known libraries, such as OpenSSL, and a widely used compiler, POCO C++, resulting in 99% of the more than 3 megabytes of code being classified as benign, according to Cylance's analysis.

Those steps, taken along with other newly adopted tactics, suggest the group is trying a different approach to dodge evolving defenses, Lemos says.

"It would be odd for them to shift tactics without a reason," he says. "That is what is giving us the belief that this is a response to a lot of players in the industry having shifted to static ML and even the heuristics engines and traditional AV scanners — those are going to have challenges keying in on malicious bits of this code."

Attackers have used a variety of ways to dodge host-based defenses in the past, most often involving encrypting, or "packing," parts of the file to prevent antivirus (AV) scanners from recognizing the malicious parts of the code. In addition, attackers have used domain generation algorithms (DGAs) to download code at a later date from hard-to-predict locations, defeating initial scans that look for malicious code, the report says.

Camouflaging malware as legitimate code is old hat for cybercriminals. Deception is a key part of their toolkits. Attempting to deceive machine-learning (ML) algorithms designed to spot malicious code features is more difficult.

"Machine learning is going to look at the static code and say, 'Almost all of this is good code,'" Lemos says. "That may bias [the algorithm] toward labeling it 'good' in the machine-learning decision."

APT28 has operated since at least 2007, according to an initial 2014 analysis by FireEye. The group has largely not focused on intellectual property theft, as some Chinese APT groups do, but instead steals government secrets, the company says in its report.

"Since at least 2007, APT28 has been targeting privileged information related to governments, militaries and security organizations that would likely benefit the Russian government," the analysis states. "APT28 has systematically evolved its malware since 2007, using flexible and lasting platforms indicative of plans for long-term use and sophisticated coding practices that suggest an interest in complicating reverse engineering efforts."

The US Cyber Command (USCYBERCOM) submitted the sample for the implant in May to the VirusTotal scanning service, which is run by Google. The action is part of an initiative, which started in November 2018, where the agency issues a sample to VirusTotal and then sends a tweet directing analysts to the sample. The initiative essentially notifies the industry of significant threats and results in a great deal of crowdsourced research into the code.

Almost all of the malware submitted to VirusTotal came from Russian-linked operations, according to security experts. The notable exceptions: On July 3, the cybersecurity agency warned that a group — identified as Iranian by security firms — was using an Outlook vulnerability to exploit targets.

Cylance is the latest security firm to take a look at the tools used by the Russian cyber-espionage group, which is blamed for cyberattacks on the nation of Georgia prior to Russia's 2008 invasion, and for compromising computers at the US Democratic National Committee to steal e-mails and other sensitive data prior to the 2016 presidential election

In 2019, for example, security firm ESET published an analysis of the Zebrocy malware, one of the payloads of the APT28/Fancy Bear group, which had more than 30 commands that could be used for network and system reconnaissance. Unlike Cylance, ESET used active telemetry to gain insight into what the malware did once it was on a system.

While the latest techniques could cause problems for detection approaches based on machine-learning and heuristics, active approaches — such as watching for malicious behavior — are less likely to be fooled, Cylance's Lemos says.

"Looking at code in multiple ways — that is very purposeful," he says. "It does take a very blended approach for good defense these days."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Right to Be Patched: How Sentient Robots Will Change InfoSec Management."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19642
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
CVE-2019-19637
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19638
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
CVE-2019-19635
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19636
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.