NOBELIUM (APT29) has launched a targeted EU campaign aimed at governments assisting Ukraine, utilizing geopolitically themed lure content tied to Poland’s diplomatic activity. The operation combines weaponized HTML/ISO dropper techniques and Notion-based C2 through compromised infrastructure to deliver and execute payloads within target networks. #NOBELIUM #APT29 #NotionAPI #EnvyScout #ROOTSAW #LegisWrite #PolandMinistryOfForeignAffairs
Keypoints
- NOBELIUM (APT29) is the threat actor behind the campaign described by BlackBerry researchers.
- The campaign targets EU governments, with emphasis on ministries and official channels.
- Attack chain includes spear-phishing emails that link to weaponized HTML leading to ISO dropper payloads.
- Weaponized HTML uses HTML smuggling to deliver an ISO containing DLL and LNK payloads.
- Notion API is used as a C2 channel, leveraging compromised infrastructure to hide communications.
- Anti-forensic and persistence techniques are used, including registry Run keys and obfuscated strings.
MITRE Techniques
- [T1584.006] Compromising legitimate web servers to spread downloaders – The campaign uses a weaponized HTML dropper hosted on compromised legitimate websites to deliver payloads. “The weaponized URLs shown above are hosted on a legitimate online library website based in El Salvador in Central America. We believe that the threat actor compromised this website sometime between the end of January 2023 and the beginning of February 2023.”
- [T1566.002] Spear-phishing email with link to malicious website – The infection vector is a targeted phishing email containing a weaponized document, with a link to HTML download. “The infection vector for this particular campaign is a targeted phishing email containing a weaponized document. The malicious document includes a link leading to the download of an HTML file.”
- [T1204.002] Malicious .lnk files inside of weaponized ISO images – The weaponized ISO drops two files, including .lnk, executed via rundll32.exe. “The weaponized URLs shown above… and the two files, with the same hash for both: BugSplatRc64.dll and .lnk.”
- [T1547.001] Execution through Autorun – Persistence through a Run key in the registry, enabling startup execution. “To remain persistent on the infected system, a new registry key is created under: ‘HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunDsDiBacks’ … ‘C:WindowsSystem32rundll32.exe “C:UsersAppDataLocalDsDiBacksBugSplatRc64.dll,InitiateDs”‘.”
- [T1027.006] Malicious HTML obfuscation – HTML content contains a data block that is decoded (by subtracting 4) to reveal an ISO. “The HTML file delivered in this campaign contains a data block that can be decoded by subtracting 4.”
- [T1102.002] Communicating via Notion API – C2 communications occur over the Notion API, disguising traffic as legitimate Notion usage. “The packed malware utilizes api.notion.com for its C2 communication. Notion is a commonly used note-taking application.”
Indicators of Compromise
- [SHA256] Malware file identifiers – 21a0b617431850a9ea2698515c277cbd95de4e59c493d0d8f194f3808eb16354, 505f1e5aed542e8bfdb0052bbe8d3a2a9b08fc66ae49efbc9d9188a44c3870ed
- [MD5] Malware file identifiers – 67a6774fbc01eb838db364d4aa946a98, e693777A3A85583A1BBBD569415BE09C
- [IP] Command-and-control / hosting – 108.167.180.186
- [URL] Dropper hosting URLs (obfuscated) – hxxps[:]//literaturaelsalvador[.]com/Instructions[.]html, hxxps[:]//literaturaelsalvador[.]com/Schedule[.]html
- [SHA256] Additional dropper artifacts – dffaefaabbcf6da029f927e67e38c0d1e6271bf998040cfd6d8c50a4eff639df, 38b05aa4b5ba651ba95f7173c5145270
- [File] Dropped payload components in ISO – BugSplatRc64.dll, Schedule.lnk, Instructions.lnk
Read more: https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine