CANCUN, Mexico--(BUSINESS WIRE)--Kaspersky Lab researchers have observed that the Russian-speaking threat actor Sofacy, also known as APT28 or Fancy Bear, is shifting its targeting to the Far East, with a strong interest in military, defense and diplomatic organizations – in addition to its traditional NATO-related targets. The researchers discovered that Sofacy sometimes overlaps with other threat actors when targeting victims, including with the Russian-speaking Turla and the Chinese-speaking Danti. In addition, Sofacy backdoors were found on a server previously compromised by the English-language threat actor behind the Lamberts. The server belongs to a military and aerospace conglomerate in China.
Sofacy is a highly active and prolific cyberespionage group that Kaspersky Lab researchers have been tracking for many years. In February, Kaspersky Lab published an overview of Sofacy’s activities in 2017, revealing a gradual move away from NATO-related targets towards the Middle East, Central Asia and beyond. Sofacy uses spear-phishing and sometimes water-holing to steal information, including account credentials, sensitive communications and documents. It is also suspected of delivering destructive payloads to various targets.
The new findings show that Sofacy is not the only predator stalking these regions, and that this sometimes results in a target overlap between very different threat actors. In the case of Sofacy, researchers found scenarios where its Zebrocy malware competed for victim access with Russian-speaking Mosquito Turla clusters; and where its SPLM backdoor competed with traditional Turla and Chinese-speaking Danti attacks. The shared targets included government administration, technology, science and military-related organizations in or from Central Asia.
In some cases, targets appeared to be subjected simultaneously to separate attacks from both SPLM and Zebrocy. However, the most intriguing overlap is probably that between Sofacy and the English-speaking threat actor behind the Lamberts. The connection was discovered after researchers detected the presence of Sofacy on a server that threat intelligence had previously identified as compromised by Grey Lambert malware. The server belongs to a Chinese conglomerate that designs and manufactures aerospace as well as air defense technologies.
In this example, the original SPLM delivery vector for Sofacy remains unknown. This raises a number of hypothetical possibilities, including the fact that Sofacy could be using a new and as yet undetected exploit or a new strain of its backdoor; or that Sofacy had somehow managed to harness Grey Lambert’s communication channels to download its malware. It could even mean that the Sofacy indicators could be a false flag, planted by the previous Lambert presence. Researchers believe the most likely answer is that an unknown new PowerShell script or legitimate, but vulnerable, web app was exploited to load and execute the SPLM code in this instance.
“Sofacy is sometimes portrayed as wild and reckless, but as seen under our visibility, the group can be pragmatic, measured and agile. Their activity in the East has been largely under-reported, but they are clearly not the only threat actor interested in this region, or even in the same targets,” said Kurt Baumgartner, principal security researcher, Kaspersky Lab. “As the threat landscape grows ever more crowded and complex, we may encounter more examples of target overlap – and it could explain why many threat actors check victim systems for the presence of other intruders before fully launching their attacks.”
Researchers also found that Sofacy now maintains distinct subdivisions for each of its main tools, with clusters for the coding, development and targeting of SPLM (also known as CHOPSTICK and Xagent), GAMEFISH and Zebrocy. SPLM is considered to be Sofacy’s primary and most selective second stage tool, while Zebrocy is used for high volume attacks. According to researchers, in early 2018, Sofacy targeted large air defense-related commercial organizations in China with SPLM, while deploying Zebrocy more widely across Armenia, Turkey, Kazahkstan, Tajikistan, Afghanistan, Mongolia, China and Japan.
All Kaspersky Lab products successfully detect and block all known Sofacy attacks, and some more challenging disinfections may require a reboot.
For organizations with military, defense and foreign affairs-related operations in the affected regions, Kaspersky Lab recommends implementing the following measures to avoid falling victim to an advanced targeted attack:
- Use a proven corporate grade security solution in combination with anti-targeted attack technologies and threat intelligence, like Kaspersky Threat Management and Defense. These solutions are capable of spotting and catching advanced targeted attacks by analyzing network anomalies and give cybersecurity teams full visibility over the network and response automation;
- Provide security staff with access to the latest threat intelligence data, which will arm them with helpful tools for targeted attack research and prevention, such as indicators of compromise (IOC), YARA and customized advanced threat reporting;
- If you spot early indicators of a targeted attack, consider managed protection services that will allow you to proactively detect advanced threats, reduce dwell time and arrange timely incident response.
Further details of Sofacy activity in 2018 and technical information on its evolving tools can be found on Securelist.
About Kaspersky Lab
Kaspersky Lab is a global cybersecurity company, which has been operating in the market for over 20 years. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into next generation security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.