Pierluigi Paganini October 24, 2017

Russian cyber espionage group APT28 targeted individuals with spear-phishing messages using documents referencing a NATO cybersecurity conference.

Researchers with Cisco Talos have spotted a Russian cyber espionage group targeting individuals with spear-phishing messages using documents referencing a NATO cybersecurity conference.

Experts attributed the attack to the dreaded Russian APT28 group, aka Pawn Storm, Fancy Bear, Sofacy, Group 74, Sednit, Tsar Team and Strontium.

The hackers targeted individuals with a specific interest in the CyCon US cybersecurity conference organized by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in collaboration with the Army Cyber Institute at West Point on November 7-8 in Washington, D.C.

The state-sponsored hackers used bait documents containing content copied from the official CyCon U.S. website, the attackers were clearly interested in spying on cybersecurity experts.

“Cisco Talos discovered a new malicious campaign from the well known actor Group 74 (aka Tsar Team, Sofacy, APT28, Fancy Bear…). Ironically the decoy document is a deceptive flyer relating to the Cyber Conflict U.S. conference. CyCon US is a collaborative effort between the Army Cyber Institute at the United States Military Academy and the NATO Cooperative Cyber Military Academy and the NATO Cooperative Cyber Defence Centre of Excellence.” states the report published by CISCO Talos.

“Due to the nature of this document, we assume that this campaign targets people with an interest in cyber security.”

The technique to use cyber security conferences as a lure in cyber espionage operations is well known, other threat actors in the past used the same tactic. Last year, a Chinese cyber espionage group known as Lotus Blossom attempted to lure victims with fake invitations to a Palo Alto Networks’ Cybersecurity Summit.

The attackers didn’t use any zero-day vulnerabilities in this last campaign, instead, they relied on weaponized Office documents containing VBA scripts used to deliver a new variant of Seduploader (also known as GAMEFISH backdoor, Sednit, JHUHUGIT and Sofacy).

The Seduploader malware, also known as GAMEFISH backdoor, Sednit, JHUHUGIT and Sofacy, is a strain of malware that has been already used by the threat actor in other campaigns against NATO representatives.

“In the previous campaign where adversaries used Office document exploits as an infection vector, the payload was executed in the Office word process. In this campaign, adversaries did not use any exploit. Instead, the payload is executed in standalone mode by rundll32.exe,” continues the report.

The Seduploader is a reconnaissance malware that was used for years by APT28, it is composed of 2 files: a dropper and a payload. The experts noticed that dropper and the payload are quite similar to the previous versions but the author modified some public information such as MUTEX name, obfuscation keys.

Hackers made these modifications to avoid detection of security solutions.

The CCDCOE published an alert on its website to warn people interested in the CyCon conference about the attack.

“Information from CyCon U.S. website has been used in a Word document with an intent to deliver malware. This type of attack, where legitimate information is used to attract the attention of victims, is rather common and normally detected and prevented in information systems with widely used safeguards.” reads the alert.

“This is clearly an attempt to exploit the credibility of Army Cyber Institute and NATO CCDCOE in order to target high-ranking officials and experts of cyber security,”

Pierluigi Paganini

(Security Affairs – APT28, cyber espionage)

[adrotate banner=”5″]

[adrotate banner=”13″]