Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

11/10/2016
03:55 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Russian Hackers Behind DNC Breach Wage Post-US Election Attacks

Less than six hours after Donald Trump was named President-Elect of the US, Cozy Bear/APT29/CozyDuke nation-state hackers kicked off waves of spearphishing attacks.

Russia's cyber-spying machine was in full force within six hours of the final US Presidential election results with at least five different waves of spear-phishing campaigns targeting users associated with US think-tanks and non-governmental organizations.

Researchers with Volexity posted their findings surrounding a jump in spearphishing activity by the so-called Russian hacking group known as Cozy Bear, APT29, and CozyDuke, best known for its recent breach of the Democratic National Committee (DNC). There were five different spearphishing campaigns spotted by Volexity, including attacks posing as emails forwarded from the Clinton Foundation, and two others posing as eFax URLs or documents.

"These e-mails came from a mix of attacker-created Google Gmail accounts and what appears to be compromised e-mail accounts at Harvard’s Faculty of Arts and Sciences (FAS). These e-mails were sent in large quantities to different individuals across many organizations and individuals focusing in national security, defense, international affairs, public policy, and European and Asian studies," said Steven Adair, founder at Volexity, in a post yesterday.

Think-tanks and NGOs have been common targets of the group, also known as The Dukes, since July of 2015.

"The Dukes continue to launch well-crafted and clever attack campaigns. They have had tremendous success evading anti-virus and anti-malware solutions at both the desktop and mail gateway levels," Adair wrote.

The group employs anti-VM macros and PowerShell scripts that help them bypass sandboxes that could detect them, for instance. "This combined with their use of steganography to hide their backdoor within PNG files that are downloaded remotely and loaded in memory only or via alternate data streams (ADS) is quite novel in its approach," he said. "Volexity believes that the Dukes are likely working to gain long-term access into think tanks and NGOs and will continue to launch new attacks for the foreseeable future."

The first spear-phishing attack wave uses a lure of the "The Shocking Truth About Election-Rigging in the United States." The email is purportedly an electronic fax from Secure Fax Corp., and contains a link to a ZIP file. That file has a Microsoft .LNK file that houses PowerShell commands, which execute anti-virtual machine checks and install a backdoor onto the victim's machine.

"The PowerDuke backdoor boasts a pretty extensive list of features that allow the Dukes to examine and control a system. Volexity suspects the feature set that has been built into PowerDuke is an extension of their anti-VM capabilities in the initial dropper files," Adair wrote. "Several commands supported by PowerDuke facilitate getting information about the system." 

Dark Reading's all-day virtual event Nov. 15 offers an in-depth look at myths surrounding data defense and how to put business on a more effective security path. 

 

In the second attack wave, the hackers uses a Word document with a malicious macro that checks for anti-VM features, and appears to come from [email protected] The subject line is "Incoming eFax: Elections Outcome Could Be revised [Facts of Elections Fraud]."

The most widespread attack was the third one, which uses an email purportedly from Harvard's "PDF Mobile Service," which doesn’t actually exist. (There appears to be a typo in the message as well, calling it "PFD Mobile Service" as well). The subject line: "Why American Elections Are Flawed." This one uses a ZIP file to mask the malicious executable.

The Clinton Foundation is the lure for the fourth and fifth waves of spearphishing campaigns by the hacking group. The first one uses "Clinton Foundation FYI #1" in its subject line, and deploys a Word document with a malicious embedded macro. The macro checks for anti-VM features. The email purportedly comes from the fictitious Harvard PDF Mobile Service.

Then there's the "Clinton Foundation FYI #2" email wave from the same "Harvard" email address, which contains a link to a ZIP file with an LNK file embedded. It contains the signature PowerShell commands that look for anti-VM, and installs a backdoor on the victim's machine.

"Like Attack Wave #3, this e-mail message also purported to be forwarded from Laura Graham at the Clinton Foundation. The message body contained dozens of e-mail addresses to which the message originally claims to have been sent, with organizations similar to Attack Wave #3," Adair wrote.

Volexity's post includes screenshots of the emails and code snippets.

Related Content:

Save

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
JoeM066
50%
50%
JoeM066,
User Rank: Strategist
11/11/2016 | 10:14:27 AM
Typo
"stenography" should be "steganography".
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
11/11/2016 | 11:01:13 AM
Re: Typo
Thank you for the catch. There definitely was a typo in the Volexity blog... now it's been corrected in our article. =)

 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
11/11/2016 | 11:04:20 AM
Re: Typo
Thank you for the catch. There definitely was a typo in the Volexity blog... now it's been corrected in our article. =)

 
CJETT624
50%
50%
CJETT624,
User Rank: Apprentice
11/11/2016 | 10:36:35 AM
Possible Russian Hackers maybe Kapersky Institute security software sold in USA and around the world
check Kapersky institute out for hackers

 
lucysecurity
50%
50%
lucysecurity,
User Rank: Apprentice
11/11/2016 | 4:03:19 PM
The Phishing Message looks like a LUCY Attack Simulation Template
Thank you for your article! The interesting fact is that the real Phishing e-mails look the same as our own best practice DIY phishing simulation templates which we provide together with LUCY Server! Obviously the cyber criminals are using best practices too: Our customers and partners say that the eFax Attack is a scenario with a high penetration rate! See our article on lucysecurity.com

 

Best Regards Palo
Lily652
50%
50%
Lily652,
User Rank: Moderator
11/12/2016 | 4:58:47 AM
prayer times

I've been surfing online more than three hours today, yet I never found any interesting article like yours. It's pretty worth enough for me. In my opinion, if all webmasters and bloggers made good content as you did, the web will be a lot more useful than ever before. 

Benefiter
50%
50%
Benefiter,
User Rank: Apprentice
11/12/2016 | 10:12:09 AM
Re:
I really like your page and the of the author's style . I always loking for your new posts. Thank you, I really like it, it is useful
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8860
PUBLISHED: 2020-02-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devices with Exynos chipsets. User interaction is required to exploit this vulnerability in that the target must answer a phone call. ...
CVE-2020-8861
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue...
CVE-2020-8862
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the...
CVE-2020-9330
PUBLISHED: 2020-02-21
Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP a...
CVE-2020-9327
PUBLISHED: 2020-02-21
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.