Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive

MITRE Techniques

• [T1566.001] Phishing: Spearphishing Attachment – The lure PDFs (Agenda.pdf) were used to deliver the initial payloads. Quote: “…phishing documents contained a link to a malicious HTML file (EnvyScout) that served as a dropper…”
• [T1566.002] Phishing: Spearphishing Link – Agenda.pdf included links to Agenda.html hosted on cloud storage. Quote: “Link: www.dropbox[.]com/s/dhueerinrg9k97k/agenda.html?dl=1”
• [T1036] Masquerading – Agenda.exe is an Adobe-signed binary repurposed to evade defenses. Quote: “Agenda.exe – Adobe Executable … digitally signed by Adobe, Inc., and is being used to evade detection … by abusing the trust of digitally signed applications.”
• [T1059.003] Windows Command Shell – The infection flow uses cmd.exe to start agenda.exe. Quote: “cmd.exe is used to execute agenda.exe in the current working directory.”
• [T1574.001] DLL Side-Loading – Vcruntime140.dll is hijacked to load the actor’s DLL vctool140.dll. Quote: “Vcruntime140.dll is a DLL loaded by agenda.exe… not the legitimate Microsoft file, as it has been altered to load the actor’s malicious DLL, vctool140.dll.”
• [T1055] Process Injection/In-Memory Execution – The payload is decompressed and loaded in memory (in-memory execution of the loader and payload). Quote: “loads and executes downloaded payload file in memory.”
• [T1082] System Information Discovery – The Google Drive payload collects machine information. Quote: “Retrieves information from the victim such as: running processes, machine name and network IP information.”
• [T1057] Process Discovery – The payload gathers running processes as part of its reconnaissance. Quote: “retrieves information from the victim such as: running processes…”
• [T1567.002] Exfiltration to Cloud Storage – Data is uploaded to Google Drive shares. Quote: “Uploads the data collected … to the Google Drive share with a unique client ID…”
• [T1071.001] Web Protocols / C2 over Web Services – Cobalt Strike beacons and C2 communications with external domains. Quote: “Command and control (C2) comms established with crossfity[.]com.”