Blog

MALEWARE MORE INFORMATION

SENIOR CHIEF EDITOR CHRISTOPHER VERA

SOURCE WIKILEAKS 

IMAGE CREDIT VENTURE BEAT

Sorry david,
I thought you were the “David” I met at the last ICCS in Washington.
Anyway, thanks again for the information you are sharing and the last mail regarding the russian malware.
As you, I am very interested in knowing where the malware comes from and who build it, unfortunatly, giving the fathership to any malware is very difficult.
Considering the three operation discribed in your mail, I’ll be very interested in learning how, for sure, you can attribuate the origin to the russian. for sure, there are clues but so many way to mix them up.

Thanks a lot for all your work.

Regards

Stephane

——– Message original ——–
Sujet : [INTERNET] Re: Breaking the Code on Russian Malware
De : David Vincenzetti <d.vincenzetti@hackingteam.com>
Pour : ROBINOT Stephane <stephane.robinot@interieur.gouv.fr>
Date : 29/11/2014 06:05
Good morning Sir,
I am afraid I don’t speak French, I am sorry.
I only figured out that you are interested in discussing about Russian malware.
I wonder if you would mind communicating with me in English, please.
Regards,

David
— 
David Vincenzetti 
CEO

Hacking Team
Milan Singapore Washington DC
www.hackingteam.com
On Nov 28, 2014, at 2:45 PM, ROBINOT Stephane <stephane.robinot@interieur.gouv.fr> wrote:
Bonjour David et merci pour toutes ces informations.

MA préoccupation, tout comme la votre, réside dans la réalité de l’attribution.
Je serais très heureux de discuter avec vous sur l’attribution et la certitude de celle-ci aux trois opérations mentionnées dans votre mail.

Cordialement

Stéphane Robinot
Ministère de l’Intérieur

——– Message original ——–
Sujet : [INTERNET] Breaking the Code on Russian Malware
De : David Vincenzetti <d.vincenzetti@hackingteam.com>
Pour : list@hackingteam.it
Date : 27/11/2014 04:41
Please find a TRULY EXCELLENT report on Russian cyber capabilities.
By Recorded Future, an authoritative and highly distinguished computer security company.
“There are primarily three families of Russian malware: [#1] Uroburos, [#2] Energetic Bear, and [#3] APT28. This analysis will lay out the various names given to these threats by the security community as well as provide the malware’s access delivery mechanism, such as spear-phishing and watering hole attacks. Additionally, each group has its unique access vector, exploit/vulnerability, and toolkit.”

“In examining each in combination it appears each Russian malware group has been designed with different cyber objectives in mind. The three goals include using cyber intrusions to conduct espionage, pre-position Russian accesses for future cyber warfare, and to meddle and monitor geopolitical threat’s in Russia’s backyard. Behind the scenes these goals may provide clues into the organizations and actors that conduct these nefarious attacks.”

[…]

“Russia’s three major malware groups each have distinct operational objectives. From espionage, cyber warfare, and tracking regional geopolitical foes, Russia continues to build a cyber capability with the potential to impact organizations worldwide. The scope of Russian cyber operations has only recently been discovered by cyber security firms. In contrast, Chinese cyber operations have been known for over a decade due to their sloppy operational procedures and direct attribution. Russia however, continues to lead the way in stealthier malware and operations making their efforts harder to identify and analyze.”

“Each of these groups have disparate targets despite using similar delivery mechanisms. While all of these intrusions utilize user behavior in order to facilitate access to their victims, the varying objectives of each group indicates a strategic level of planning. Furthermore, the lack of cohabitation of the different malware families in the wild is notable. This indicates coordination at the tactical, operational, and strategic level. This kind of coordination is indicative of Russia’s well-known reputation as an advanced cyber threat.”
Enjoy the reading — Have a great day!

Also available at , https://www.recordedfuture.com/russian-malware-analysis/ , FYI,

David
Breaking the Code on Russian Malware

Posted by Jennifer on November 20, 2014 in Cyber Threat Intelligence

<Mail Attachment.png>
Russia poses a serious cyber threat to industrial control systems (ICS), pharmaceutical, defense, aviation, and petroleum companies. Russian government cyber operations aim to use malware to steal information on files, persist on ICS equipment, and commit espionage. According to a 2014 GData Red Paper, Uroburos malware’s “modular structure allows extending it with new features easily, which makes it not only highly sophisticated but also highly flexible and dangerous.” Understanding these threats posed by the malware and Russia’s objectives will go a long way to securing networks.

There is nothing quick about studying Russian cyber operations. Beyond understanding the complexities of the malware itself, one must also match up the names of several families of malware, some which have evolved over time and have had different names, as well as to link together the names given to specific groups by a number of private security companies. As many as five different codewords have been given to Russian Federation sponsored cyber campaigns by companies such as Kaspersky, iSIGHT Partners, Symantec, FireEye/Mandiant.

To further complicate research and analysis, the codewords represent different facets of the malware problem, some are grouped by signatures, some by actors, others by tools. Before understanding the cyber threat posed by Russia one must make sense of the tremendous amount of documentation on the problem and connect the codewords to unlock potentially missed data and trends when conducting threat analysis.

Malware rooted in Russia has been attacking a variety of political, military, and economic targets for a least the past seven years.
<Mail Attachment.png>
Russian Malware Analysis

There are primarily three families of Russian malware: Uroburos, Energetic Bear, and APT28. This analysis will lay out the various names given to these threats by the security community as well as provide the malware’s access delivery mechanism, such as spear-phishing and watering hole attacks. Additionally, each group has its unique access vector, exploit/vulnerability, and toolkit.

In examining each in combination it appears each Russian malware group has been designed with different cyber objectives in mind. The three goals include using cyber intrusions to conduct espionage, pre-position Russian accesses for future cyber warfare, and to meddle and monitor geopolitical threat’s in Russia’s backyard. Behind the scenes these goals may provide clues into the organizations and actors that conduct these nefarious attacks.
#1 Uroburos Malware

IDENTIFIERS

Epic Turla – Kaspersky Labs

Uroburos – G Data Software AG

Snake – BAE Systems

SnakeNet

TARGETS

Governments

Embassies

Defense Industry

Research and Education

Pharmaceutical Industry

ACCESS DELIVERY

Spear Phishing

Watering Hole Attacks

ACCESS VECTOR

CVE-2013-5065

CVE-2013-3346

CVE-2012-1723

.SCR Files (some RAR packed)

Fake “Flash Player” installations via watering holes

TOOLS

Agent.BTZ – Agent.AWF/muxbde40.dll

Epic Turla – Stage 1 Backdoor

Cobra Carbon System – Intermediary Upgrades – Stage 2

Snake Uroburos – Sophisticated Platform: Rootkit and Virtual File System – Stage 3

Zagruzchik.dll

Cobra/Carbon/Pfinet

WorldCupSec/TadjMakhal/Wipbot/Tavdig
<Mail Attachment.png>
The earliest reported attacks involved Agent.BTZ malware intrusion into DoD networks in 2008.
<Mail Attachment.png>
Since that time, Agent.BTZ evolved into Uroburos. According to the aforementioned G Data 2014 Red Paper, “Due to many technical details (file name, encryption keys, behavior and more details mentioned in this report), we assume that the group behind Uroburos is the same group that performed a cyber attack against the United States of America in 2008 with a malware called Agent.BTZ. Uroburos checks for the presence of Agent.BTZ and remains inactive if it is installed.” Based on the targets of this malware, both political and economic espionage seem to be at the root of the Uroburos attackers.

A targeted user receives an email with an attachment containing an executable RAR self-extracting archive (SFX). After opening the executable with an .SCR extension, the RAR SFX archive unpacks the malware and installs it into the appropriate location and then runs the malware. This attack relies heavily on user deception, not technical sophistication. Russian operators likely have had to resort to the .SCR exploitation option when they have lacked usable available exploits (i.e. when exploits have been patched).
#2 Energetic Bear Malware

IDENTIFIERS

Energetic Bear – CrowdStrike

Crouching Yeti – Kaspersky Labs

Koala Team – iSIGHT Partners

Dragonfly – Symantec

TARGETS

Aviation Industry

Defense Industry

Energy Industry

ICS Equipment Manufacturers

Petroleum Pipeline Operators

ACCESS DELIVERY

Spear Phishing

Watering Hole Attacks

ACCESS VECTOR

LightsOut Exploit Kit

Hello Exploit Kit

TOOLS

Backdoor.Oldrea

Trojan.Karagany

Energetic Bear RAT

Havex

<Mail Attachment.png>
<Mail Attachment.png>
The Energetic Bear group is unique in that its target objective is to maintain long-term persistent access to the energy industry, ICS manufacturers, aviation, and defense. This is further evident by Energetic Bear’s focus on ICS manufacturers and not just deployed ICS assets. This may be the work of a military group pre-positioning itself for a computer network attack as a tool to fulfill military or political goals. Parallels can be drawn between Energetic Bear and Stuxnet in terms of its victimology and focus on ICS equipment.
#3 APT28 Malware

IDENTIFIERS

Tsar Team/Group – iSIGHT Partners

Sednit – ESET

APT28 – Mandiant

Fancy Bear – CrowdStrike

Operation Pawn Storm – Trend Micro

ACCESS DELIVERY

Spear Phishing

ACCESS VECTOR

CVE-2010-3333

CVE-2012-0158

CVE-2014-1761

CVE-2013-1347

CVE-2013-3897

CVE-2014-1776

TOOLS

Sofacy

Win32/Sednit

SOURFACE – netids.dll

OLDBAIT

CHOPSTICK

CORESHELL – coreshell.dll

EVILTOSS

TARGETS

Eastern Europe Government and Military Institutions (Georgia)

Defense Industry

Direct Theater-Specific Threats to Russia

<Mail Attachment.png>
As far back as 2007, APT28 has been targeting Eastern European organizations that appear to be a direct threat to the current Russian government. According to AlienVault, this group “uses phishing campaigns to redirect victims to Outlook Web Access (OWA) portals designed to impersonate the legitimate OWA site of the victim’s company.” APT28 has also focused on intrusions into Georgia’s Ministry of Defense further exemplifying their focus on regional geopolitical threats.
<Mail Attachment.png>
Conclusions

Russia’s three major malware groups each have distinct operational objectives. From espionage, cyber warfare, and tracking regional geopolitical foes, Russia continues to build a cyber capability with the potential to impact organizations worldwide. The scope of Russian cyber operations has only recently been discovered by cyber security firms. In contrast, Chinese cyber operations have been known for over a decade due to their sloppy operational procedures and direct attribution. Russia however, continues to lead the way in stealthier malware and operations making their efforts harder to identify and analyze.

Although these intrusions have been identified and are widely attributed to Russia’s government, there are several others whose attribution to the Russian Federation is less clear like MiniDuke, CosmicDuke, BlackEnergy Bot, Sandworm, and Quedagh.

Each of these groups have disparate targets despite using similar delivery mechanisms. While all of these intrusions utilize user behavior in order to facilitate access to their victims, the varying objectives of each group indicates a strategic level of planning. Furthermore, the lack of cohabitation of the different malware families in the wild is notable. This indicates coordination at the tactical, operational, and strategic level. This kind of coordination is indicative of Russia’s well-known reputation as an advanced cyber threat.

— 
David Vincenzetti 
CEO

Hacking Team
Milan Singapore Washington DC
www.hackingteam.com

Rate This Article:
No comments

leave a comment