Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/17/2019
10:45 AM
50%
50%

Cozy Bear Emerges from Hibernation to Hack EU Ministries

The cyber-espionage group, linked to Russia and blamed for hacking the Democratic National Committee in 2016, has been using covert communications and other techniques to escape detection for at least two years.

Following its compromise of the network and servers of the Democratic National Committee (DNC) in 2016, the Russia-linked espionage group Cozy Bear, also known as APT29 and the Dukes, has focused on staying off the radar of intelligence services and security companies.

Yet the group has remained active, using covert communications — such as hiding information and commands in images, a technique known as steganography — to remain largely undetected. According to a report published today by security firm ESET, the group has compromised three European ministries of foreign affairs and the Washington, DC, embassy of an EU member. The report suggests that even after Cozy Bear was in the spotlight following the DNC breach, it recovered and rebuilt most of its tools and operations.

"Even if the group has managed to avoid public scrutiny for several years, they actually were very active compromising high-value targets and developing new tools," says Matthieu Faou, a malware researcher with ESET. "They have been operational for around 10 years, starting around 2008 [or] 2009. Since then, they have been active almost all the time."

As the United States starts another election cycle, this one promising to be even more chaotic than the last, signs of cyberattacks have garnered increasing attention. Cozy Bear has typically targeted Western countries or nations that had been part of the former USSR.

"Besides governments, the group also has targeted various organizations linked to NATO, think tanks, and political parties," ESET stated in the report. "This targeting suggests a clear interest in collecting information allowing a better understanding of future international political decisions, which would seem of most interest to a government."

The ESET report is not the only research to attribute attacks to the group. In 2018, security and incident-response firm FireEye linked phishing attacks purporting to be from the US Department of State to APT29 — its monicker for the Cozy Bear group. The attacks attempted to compromise systems in the government, defense, pharmaceutical, and transportation sectors, the company said at the time.

The connection to Cozy Bear, however, was circumstantial. The attackers used some tools and techniques that were hallmarks of the Cozy Bear group but could have been co-opted by another attacker as part of a "false flag" operation. In the current investigation, the group tracked by ESET used a spear-phishing campaign to kick off the attacks — a technique linked to Cozy Bear.

This time around, Cozy Bear — which ESET refers to as The Dukes — has used a variety of covert and public channels for communication in an attempt to escape detection. 

The group has used Twitter, Imgur, and Reddit as a primary way to issue commands to systems immediately after compromise. Cozy Bear generates new Twitter handles using an algorithm generator, from which compromised machines will fetch encrypted URLs.

The group also has used public cloud services, such as OneDrive, to hide communications in legitimate services. Often, the group hides data inside of images, which is very hard to detect, says ESET's Faou.

"[Steganography] is quite complex to implement, so it is not that common," he says. "It's hard to detect because even after the image is altered to contain commands or payloads, it is still valid. So by looking at the network traffic only, it is hard to detect that something suspicious is ongoing."

In addition, the group is using three new malware families in its current operations, dubbed by ESET as PolyglotDuke, RegDuke, and FatDuke. ESET also discovered a fourth malware sample, LiteDuke, used in older campaigns that had not previously been described.

PolyglotDuke uses Twitter and other websites to fetch the address of the command-and-control server. RegDuke establishes persistance by hiding in the registry and using Dropbox to reconstitute a connection back to an attacker-controlled server. FatDuke is a client that is installed after the MiniDuke backdoor, offers a great deal of functionality, and uses obfuscation to make its code difficult to decipher.

The previously known MiniDuke is a backdoor that gets installed after the initial infection and allows the attacker to issue commands to the infected system. In the past, LiteDuke was used to further compromise systems after MiniDuke, but it is seems to be outdated, ESET stated.  

The group also widely uses credentials to move throughout a network, compromising additional systems and reinfecting systems while a company is still responding to an incident.

"When responding to a Dukes compromise, it is important to make sure to remove every implant in a short period of time," ESET stated in the report. "Otherwise, the attackers will use any remaining implant to compromise the cleaned systems again."

While ESET based its attribution on an accumulation of evidence, the company also stressed that it comes with a caveat and that the company does not link attacks to specific actors.

"We cannot discount the possibility of a false flag operation," the company stated in the report. "However, this campaign started while only a small portion of the Dukes' arsenal was known. In 2013, at the first known compilation date of PolyglotDuke, only MiniDuke had been documented and threat analysts were not yet aware of the importance of this threat actor."

Related Content

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Build a Rock-Solid Cybersecurity Culture."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23351
PUBLISHED: 2021-03-08
The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in ...
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...