Fancy Bear (APT28) is a Russian cyberespionage group targeting governments, military, and high-value organizations globally, notably influencing elections and exploiting webmail vulnerabilities. Their recent campaigns focus on the Ukraine conflict, espionage against Western logistics, and leveraging malicious documents in Central Asia, using sophisticated malware and phishing techniques. #FancyBear #APT28 #CHERRYSPY #HATVIBE #CVE2023-43770
Keypoints
- Fancy Bear (APT28) has been active since 2007, targeting governments, military, and political entities worldwide, including attempts to influence elections in the U.S., France, and Germany.
- The group uses spearphishing and exploits vulnerabilities in webmail platforms such as Roundcube, Horde, MDaemon, and Zimbra, including CVE-2023-43770, to gain initial access and steal credentials.
- Recent campaigns focus on espionage related to the Ukraine conflict, targeting Ukrainian officials, military suppliers, and Western companies involved in foreign aid.
- Fancy Bear uses advanced malware families, including HATVIBE (loader) and CHERRYSPY (backdoor), as well as historically Sofacy and Zebrocy, often delivered via malicious macros in weaponized documents.
- The group employs sophisticated evasion techniques such as implant switching, code obfuscation, event log clearing, and use of legitimate infrastructure for command and control.
- Their motivations include financial gain, reputational damage, espionage, and promoting a political agenda aligned with Russian interests in Central Asia and Europe.
- MITRE ATT&CK framework analysis reveals the extensive use of reconnaissance, initial access, execution, persistence, credential access, defense evasion, collection, exfiltration, and command and control techniques.
MITRE Techniques
- [T1566.001/002] Spearphishing Attachment/Link – Used for initial access with highly tailored emails containing malicious macro documents or spoofed login pages (“highly tailored emails with malicious attachments”).
- [T1190] Exploitation of Public-Facing Application – Leveraged vulnerabilities such as XSS in webmail platforms like Roundcube to execute malicious code (“leveraged cross-site scripting (XSS) vulnerabilities in various webmail software”).
- [T1110.003] Brute Force/Password Spraying – Historically used against web services (e.g., Norwegian parliament hack) to gain access via weak credentials.
- [T1204] User Execution – Victims required to open malicious documents or click links, triggering infection (“requires victims to open malicious documents or click on malicious links”).
- [T1059] Command and Scripting Interpreter – JavaScript and PowerShell used for executing malicious tasks and downloading payloads (“using JavaScript within browser contexts (XSS) or PowerShell for various tasks”).
- [T1053] Scheduled Task/Job – Malware persistence via scheduled tasks such as HATVIBE running periodically (“setting up tasks to run malware periodically”).
- [T1547] Boot or Logon Autostart Execution – Used Startup folders for persistence of malware execution (“using Startup folders for persistent execution”).
- [T1098] Account Manipulation – Stolen credentials used to maintain persistent access (“stealing credentials to maintain access to accounts”).
- [T1027] Obfuscated Files or Information – Code obfuscation and junk data to evade detection (“obfuscating code, adding junk data to encoded strings”).
- [T1070] Indicator Removal – Clearing event logs to hide activity (“clearing event logs (e.g., Security and System event registries)”).
- [T1090] Proxy/C2 Channels – Routing command and control traffic through victim networks (“routing C2 traffic through compromised victim networks”).
- [T1078] Valid Accounts – Use of stolen legitimate credentials for access (“using stolen legitimate credentials”).
- [T1003] OS Credential Dumping – Stealing credentials from compromised systems (“stealing credentials/hashes from systems”).
- [T1082] System Information Discovery – Gathering environment details on compromised systems (“understanding the compromised environment”).
- [T1005] Data from Local System – Collecting emails, contacts, and login history (“stealing email messages, address books, contacts, login histories”).
- [T1041] Exfiltration Over C2 Channel – Sending stolen data back to attacker servers (“sending collected data back to C2 servers”).
- [T1102] Communication Through Legitimate Services – Abusing cloud services like Google Drive for exfiltration (“known to use services like Google Drive for data exfiltration”).
Indicators of Compromise
- [CVE] Exploited Vulnerabilities – CVE-2023-43770 (Roundcube webmail XSS), CVE-2023-23397, CVE-2023-38831, CVE-2023-20085 used in various attacks.
- [Malware] Malware Families – HATVIBE (loader), CHERRYSPY (backdoor), Zebrocy, Sofacy, STEELHOOK, and others involved in infection chains.
- [File Names] Malicious Documents – Weaponized Word documents with embedded macros used as lures.
- [Phishing] Spearphishing Emails – Targeting Ukrainian officials and military suppliers with tailored phishing emails containing malicious attachments or links.
Read more: https://www.cyfirma.com/research/apt-profile-fancy-bear-2/