Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/17/2019
10:45 AM
50%
50%

Cozy Bear Emerges from Hibernation to Hack EU Ministries

The cyber-espionage group, linked to Russia and blamed for hacking the Democratic National Committee in 2016, has been using covert communications and other techniques to escape detection for at least two years.

Following its compromise of the network and servers of the Democratic National Committee (DNC) in 2016, the Russia-linked espionage group Cozy Bear, also known as APT29 and the Dukes, has focused on staying off the radar of intelligence services and security companies.

Yet the group has remained active, using covert communications — such as hiding information and commands in images, a technique known as steganography — to remain largely undetected. According to a report published today by security firm ESET, the group has compromised three European ministries of foreign affairs and the Washington, DC, embassy of an EU member. The report suggests that even after Cozy Bear was in the spotlight following the DNC breach, it recovered and rebuilt most of its tools and operations.

"Even if the group has managed to avoid public scrutiny for several years, they actually were very active compromising high-value targets and developing new tools," says Matthieu Faou, a malware researcher with ESET. "They have been operational for around 10 years, starting around 2008 [or] 2009. Since then, they have been active almost all the time."

As the United States starts another election cycle, this one promising to be even more chaotic than the last, signs of cyberattacks have garnered increasing attention. Cozy Bear has typically targeted Western countries or nations that had been part of the former USSR.

"Besides governments, the group also has targeted various organizations linked to NATO, think tanks, and political parties," ESET stated in the report. "This targeting suggests a clear interest in collecting information allowing a better understanding of future international political decisions, which would seem of most interest to a government."

The ESET report is not the only research to attribute attacks to the group. In 2018, security and incident-response firm FireEye linked phishing attacks purporting to be from the US Department of State to APT29 — its monicker for the Cozy Bear group. The attacks attempted to compromise systems in the government, defense, pharmaceutical, and transportation sectors, the company said at the time.

The connection to Cozy Bear, however, was circumstantial. The attackers used some tools and techniques that were hallmarks of the Cozy Bear group but could have been co-opted by another attacker as part of a "false flag" operation. In the current investigation, the group tracked by ESET used a spear-phishing campaign to kick off the attacks — a technique linked to Cozy Bear.

This time around, Cozy Bear — which ESET refers to as The Dukes — has used a variety of covert and public channels for communication in an attempt to escape detection. 

The group has used Twitter, Imgur, and Reddit as a primary way to issue commands to systems immediately after compromise. Cozy Bear generates new Twitter handles using an algorithm generator, from which compromised machines will fetch encrypted URLs.

The group also has used public cloud services, such as OneDrive, to hide communications in legitimate services. Often, the group hides data inside of images, which is very hard to detect, says ESET's Faou.

"[Steganography] is quite complex to implement, so it is not that common," he says. "It's hard to detect because even after the image is altered to contain commands or payloads, it is still valid. So by looking at the network traffic only, it is hard to detect that something suspicious is ongoing."

In addition, the group is using three new malware families in its current operations, dubbed by ESET as PolyglotDuke, RegDuke, and FatDuke. ESET also discovered a fourth malware sample, LiteDuke, used in older campaigns that had not previously been described.

PolyglotDuke uses Twitter and other websites to fetch the address of the command-and-control server. RegDuke establishes persistance by hiding in the registry and using Dropbox to reconstitute a connection back to an attacker-controlled server. FatDuke is a client that is installed after the MiniDuke backdoor, offers a great deal of functionality, and uses obfuscation to make its code difficult to decipher.

The previously known MiniDuke is a backdoor that gets installed after the initial infection and allows the attacker to issue commands to the infected system. In the past, LiteDuke was used to further compromise systems after MiniDuke, but it is seems to be outdated, ESET stated.  

The group also widely uses credentials to move throughout a network, compromising additional systems and reinfecting systems while a company is still responding to an incident.

"When responding to a Dukes compromise, it is important to make sure to remove every implant in a short period of time," ESET stated in the report. "Otherwise, the attackers will use any remaining implant to compromise the cleaned systems again."

While ESET based its attribution on an accumulation of evidence, the company also stressed that it comes with a caveat and that the company does not link attacks to specific actors.

"We cannot discount the possibility of a false flag operation," the company stated in the report. "However, this campaign started while only a small portion of the Dukes' arsenal was known. In 2013, at the first known compilation date of PolyglotDuke, only MiniDuke had been documented and threat analysts were not yet aware of the importance of this threat actor."

Related Content

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Build a Rock-Solid Cybersecurity Culture."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15815
PUBLISHED: 2019-11-12
ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauthorized user to access certain pages that require admin privileges.
CVE-2019-17360
PUBLISHED: 2019-11-12
A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (DoS) condition because of Uncontrolled Resource Consumption.
CVE-2018-21026
PUBLISHED: 2019-11-12
A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information.
CVE-2012-1572
PUBLISHED: 2019-11-12
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
CVE-2019-17234
PUBLISHED: 2019-11-12
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.