Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/21/2017
04:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russia's Fancy Bear APT Group Gets More Dangerous

Encryption and code refreshes to group's main attack tool have made it stealthier and harder to stop, ESET says.

Fancy Bear, the Russian advanced persistent threat group associated with the infamous intrusion at the Democratic National Committee last year among numerous other break-ins, may have become just a little bit more dangerous.

The group — also referred to as Sednit, APT28, and Sofacy — appears to have recently refurbished its primary malware tool, Xagent, and added new functionality to make it decidedly stealthier and harder to stop, security vendor ESET said in an advisory Thursday.

The modular backdoor has been a central component of Fancy Bear's campaigns for several years. Initial versions of the tool were designed to break into Windows and Linux systems. But it has been updated in the past two years to include support for iOS, Android, and, since the beginning of this year, OS X.

The fourth and latest version of the malware comes with new techniques for obfuscating strings and all run-time type information. The techniques, according to ESET, have significantly improved the malware's encryption abilities. The Fancy Bear/Sednit group also has upgraded some of the code used for command and control (C&C) purposes and added a new domain generation algorithm (DGA) feature for quickly creating fallback C&C domains.

"The previous version of Xagent modular backdoor was already very complex, but the new version is even more," says Thomas Dupuy, malware researcher at ESET.

ESET is still completing its analysis of the new features in Xagent, but the new encryption algorithm and DGA implementation are significant, he says. "The former makes the malware analysis more difficult while the latter makes domain takeover more challenging, as there are more domains to take down or seize," Dupuy says.

In addition to the encryption and DGA, Fancy Bear also has some internal improvements such as new commands that can be used for hiding malware configuration data and other data on a target system. The authors of the malware have redesigned and refactored some existing components so it has become harder to recognize previously discovered mechanisms. Xagent also now has the ability to take screenshots of the target's desktop.

The new version of Xagent has improved Fancy Bear/Sednit's ability to stay under the radar, Dupuy says. "Some of these changes are definitely related to the fact that they are trying to avoid too much attention while others are to make security researchers' jobs harder," he notes.

Otherwise, Fancy Bear/Sednit's tactics and techniques have remained largely unchanged. The group still relies heavily on the use of very cleverly crafted phishing emails to try and get targets to click on links that lead to malicious domains or to download malware.

It has largely stopped using Sedkit, an exploit kit used in numerous previous attacks, and has increasingly begun using a platform called DealersChoice to initially breach systems.

DealersChoice, according to ESET, can generate documents with embedded Adobe Flash Player exploits. One version of the platform is designed to first check which version of Flash Player a target system might be running and then exploit it. Another variant first contacts a C&C server and then deliver a selected Flash exploit.

Like the previous Sedkit exploit kit, DealersChoice is designed to scour international news stories and include references to relevant ones in the malicious emails it generates and sends to potential targets.

From a targeting standpoint, Fancy Bear/Sednit still appears to be focused on the same objectives, Dupuy says. It's still attacking government departments and embassies all over the world, with a particular interest in Eastern Europe, where the group regularly targets individuals and organizations involved in geopolitics.

Generally, Fancy Bear's tactics, techniques, and procedures have not changed a whole lot, Dupuy says. But the group has shown a tendency to vary its infection techniques, he adds. "The new version is more complex to analyze, which slows down ability to defend against the malware," he notes.

Related content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...