{"id":645,"date":"2018-12-11T13:15:03","date_gmt":"2018-12-11T11:15:03","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=645"},"modified":"2022-03-30T09:47:08","modified_gmt":"2022-03-30T09:47:08","slug":"nato-event-gang-cybercriminals","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/cyber-security-news\/nato-event-gang-cybercriminals\/","title":{"rendered":"Today’s NATO event invitation used by a gang of cybercriminals"},"content":{"rendered":"

Among the cyber attacks recorded daily, there are some of more sophisticated nature. They are called Advanced Persistent Threats (APTs)<\/strong>. These threats, among which some are state-sponsored<\/strong>, appear to be part of a Cyber Warfare<\/strong> scenario. Yet, they are as real as they can get and target specific information, such as company know-how<\/strong>, personal information<\/strong> or bank transactions<\/strong>.<\/p>\n

A team of analysts with appropriate skills and tools are necessary to identify and combat these threats.<\/p>\n

The following is an illustration of an attack which makes use of apparently reliable documents as an attack vector.<\/p>\n

Description of the attack<\/h1>\n

From the information we retrieved, the attack is attributable to the APT28 group (aka Fancy Bear or Sofacy), probably of Russian nationality, which has been using the same modus operandi  <\/em>for some years.<\/strong><\/p>\n

In the analysis of the attack we find that a Word document armed with a malicious code is used as a vector. The code is similar to other codes previously used by the APT28 group. The document is related to a NATO event to be held between 11 and 13 December (LINK TO NATO WORD DOCUMENT<\/a>).<\/p>\n

\"\"<\/p>\n

However, the Word document used by the attackers differs from the original, in that it includes a macro (which is password-protected) and a malware inside it. The malware is called SedUploader.<\/em><\/p>\n

\"NATO

NATO Word Malware<\/p><\/div>\n

The Malware<\/h1>\n

Upon opening the document, the malicious code is executed and the system is compromised. The files <\/span>UpdaterUI.dll<\/i> and <\/span>Uplist.dat<\/i> are thus created, as well as a registry key, <\/span>UlMgr<\/i>, which is meant to obtain persistence in the system.<\/span><\/p>\n\n\n\n\n
\"\"<\/td>\n<\/tr>\n
\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
\"\"<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n
\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Command and Control Server<\/h1>\n

The malware then contacts the command and control server registered at the domain <\/span>beatguitar.com<\/a><\/i> <\/span>with IP address 185.99.133.72.<\/p>\n

The malware adopts an anti-analysis technique<\/strong> that checks for the presence of Wireshark <\/em>software in the system. If so, the malware contacts the <\/span>google.com<\/a><\/i> <\/span>domain instead.<\/p>\n

Attribution – APT28\/Fan.Bear\/Sofacy<\/h1>\n

Finding the true source of the attack is <\/span>fundamental<\/b> <\/span>to identifying its objectives, intent and meaning. Getting to know this information is essential in order to undertake adequate countermeasures within the infrastructure, which span a vast array of Incident Response and Recovery <\/strong>activities as part of the company’s risk mitigation strategy.<\/p>\n

In this particular case, the identification of the APT28<\/strong> group as a source of the attack is also confirmed by the yara<\/i> <\/span>rule, which was created ad-hoc for this type of threat and shared by  analysts within <\/span>the Github<\/a> project:<\/p>\n\n\n\n\n
\"\"<\/p>\n

Yara Rule<\/p>\n<\/td>\n<\/tr>\n

\n

\"\"Rule result<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

To the same end, the analysis of \u201c<\/span>Code Intelligence<\/em>\u201d also confirms the <\/span>overlap of 97 strings of malware code <\/span><\/strong>extracted with previous saples attributable to the <\/span>APT28<\/strong> (or Sofacy) group.<\/span><\/p>\n\n\n\n
\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/div>\n
\n

Points to consider<\/span><\/h1>\n

The highly volatile and fast-paced business environment is home to many different interests, but also to increasingly more sophisticated and varied threats. In light of this, every business entity should have in place adequate cybersecurity defense<\/strong> and incident response measures  As a result, responsible and accountable governance systems will choose to invest wisely in  risk mitigation<\/strong> strategies so as to guarantee business continuity. These span a vast array of activities within the Defence and Incident Response spectrum. Our analysts use top-notch tools and have highly sought skills in the business and military environments. Fortgale is part of an international community of specialists that collaborate to extract, analyze and share fresh information 24\/7. Have a look at our array of capabilities and services here<\/a>.<\/strong><\/p>\n

References<\/span><\/h1>\n<\/div>\n

The analysis of Fortgale stems from the evidence gathered by a team of Threat Hunting, composed of @ MD0ugh, @DrunkBinary, @ r0ny_123, @Manu_De_Lucia, which identified and analyzed the threat. Further details at the link<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Among the cyber attacks recorded daily, there are some of more sophisticated nature. They are called Advanced Persistent Threats (APTs). These threats, among which some are state-sponsored, appear to be part of a Cyber Warfare scenario. Yet, they are as real as they can get and target specific information, such as company know-how, personal information or bank transactions. A team of analysts with appropriate […]<\/p>\n","protected":false},"author":1,"featured_media":564,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[33,141,435,241,328],"class_list":["post-645","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security-news","tag-apt28","tag-fancy-bear","tag-fortgale-report","tag-nato","tag-sofacy"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/645","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=645"}],"version-history":[{"count":1,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/645\/revisions"}],"predecessor-version":[{"id":4498,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/645\/revisions\/4498"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=645"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=645"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=645"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}