Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/17/2019
10:45 AM
50%
50%

Cozy Bear Emerges from Hibernation to Hack EU Ministries

The cyber-espionage group, linked to Russia and blamed for hacking the Democratic National Committee in 2016, has been using covert communications and other techniques to escape detection for at least two years.

Following its compromise of the network and servers of the Democratic National Committee (DNC) in 2016, the Russia-linked espionage group Cozy Bear, also known as APT29 and the Dukes, has focused on staying off the radar of intelligence services and security companies.

Yet the group has remained active, using covert communications — such as hiding information and commands in images, a technique known as steganography — to remain largely undetected. According to a report published today by security firm ESET, the group has compromised three European ministries of foreign affairs and the Washington, DC, embassy of an EU member. The report suggests that even after Cozy Bear was in the spotlight following the DNC breach, it recovered and rebuilt most of its tools and operations.

"Even if the group has managed to avoid public scrutiny for several years, they actually were very active compromising high-value targets and developing new tools," says Matthieu Faou, a malware researcher with ESET. "They have been operational for around 10 years, starting around 2008 [or] 2009. Since then, they have been active almost all the time."

As the United States starts another election cycle, this one promising to be even more chaotic than the last, signs of cyberattacks have garnered increasing attention. Cozy Bear has typically targeted Western countries or nations that had been part of the former USSR.

"Besides governments, the group also has targeted various organizations linked to NATO, think tanks, and political parties," ESET stated in the report. "This targeting suggests a clear interest in collecting information allowing a better understanding of future international political decisions, which would seem of most interest to a government."

The ESET report is not the only research to attribute attacks to the group. In 2018, security and incident-response firm FireEye linked phishing attacks purporting to be from the US Department of State to APT29 — its monicker for the Cozy Bear group. The attacks attempted to compromise systems in the government, defense, pharmaceutical, and transportation sectors, the company said at the time.

The connection to Cozy Bear, however, was circumstantial. The attackers used some tools and techniques that were hallmarks of the Cozy Bear group but could have been co-opted by another attacker as part of a "false flag" operation. In the current investigation, the group tracked by ESET used a spear-phishing campaign to kick off the attacks — a technique linked to Cozy Bear.

This time around, Cozy Bear — which ESET refers to as The Dukes — has used a variety of covert and public channels for communication in an attempt to escape detection. 

The group has used Twitter, Imgur, and Reddit as a primary way to issue commands to systems immediately after compromise. Cozy Bear generates new Twitter handles using an algorithm generator, from which compromised machines will fetch encrypted URLs.

The group also has used public cloud services, such as OneDrive, to hide communications in legitimate services. Often, the group hides data inside of images, which is very hard to detect, says ESET's Faou.

"[Steganography] is quite complex to implement, so it is not that common," he says. "It's hard to detect because even after the image is altered to contain commands or payloads, it is still valid. So by looking at the network traffic only, it is hard to detect that something suspicious is ongoing."

In addition, the group is using three new malware families in its current operations, dubbed by ESET as PolyglotDuke, RegDuke, and FatDuke. ESET also discovered a fourth malware sample, LiteDuke, used in older campaigns that had not previously been described.

PolyglotDuke uses Twitter and other websites to fetch the address of the command-and-control server. RegDuke establishes persistance by hiding in the registry and using Dropbox to reconstitute a connection back to an attacker-controlled server. FatDuke is a client that is installed after the MiniDuke backdoor, offers a great deal of functionality, and uses obfuscation to make its code difficult to decipher.

The previously known MiniDuke is a backdoor that gets installed after the initial infection and allows the attacker to issue commands to the infected system. In the past, LiteDuke was used to further compromise systems after MiniDuke, but it is seems to be outdated, ESET stated.  

The group also widely uses credentials to move throughout a network, compromising additional systems and reinfecting systems while a company is still responding to an incident.

"When responding to a Dukes compromise, it is important to make sure to remove every implant in a short period of time," ESET stated in the report. "Otherwise, the attackers will use any remaining implant to compromise the cleaned systems again."

While ESET based its attribution on an accumulation of evidence, the company also stressed that it comes with a caveat and that the company does not link attacks to specific actors.

"We cannot discount the possibility of a false flag operation," the company stated in the report. "However, this campaign started while only a small portion of the Dukes' arsenal was known. In 2013, at the first known compilation date of PolyglotDuke, only MiniDuke had been documented and threat analysts were not yet aware of the importance of this threat actor."

Related Content

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Build a Rock-Solid Cybersecurity Culture."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...