This week’s Shadow Talk discusses what the Cambridge Analytica revelations mean for disinformation and personal privacy, updates to Trickbot, Zeus Panda and Remnit trojans, City of Atlanta suffers from ransomware attack, and Dragonfly campaign attribution to Russian Government.
US pins energy-sector attacks on Russia-backed threat group
The United States government has named the threat group “Dragonfly” (aka Crouching Yeti, Energetic Bear) as responsible for attacks on the US energy sector over the past two years. The attribution was published in a technical alert that also connected Dragonfly to the Russian state. The multi-stage intrusion campaign of attacks was highly likely intended to gather intelligence, including credentials and files pertaining to industrial control systems (ICS) and associated systems; there was no indication of sabotage or disruption. The threat group allegedly used trusted third-party suppliers to attack its ultimate targets. The naming of Dragonfly is in line with the United States’ pervasive attribution for attacks, but is unlikely to shame the perpetrators into resisting more attacks. Instead, the attackers will likely adapt their tactics, techniques and procedures (TTPs).
Espionage group culls data from US entities with Asian interests
The suspected Chinese cyber espionage group “TEMP.Periscope” (aka Leviathan) has been cited as responsible for network intrusions of US entities with interests in the South China Sea region. To compromise networks and steal information, the group paired new tools with established tactics and techniques, including spearphishing emails and Microsoft Office exploits. The victims have not been named but, given the geopolitical conflict surrounding the South China Sea, the campaign was highly likely politically motivated and aimed at gathering intelligence. Some of the tools are associated with other suspected Chinese groups, which have also been linked to attacks on entities with interests in the same region. However, there was no indication the groups were actively collaborating, and identification of the groups is unconfirmed because many countries have interests in the South China Sea region. TEMP.Periscope has demonstrated high intent in its campaigns, and more attacks are highly likely.
Mining company extorted by thedarkoverlord
On 16 Mar 2018 breach reporting website DataBreaches[.]net reported that threat actor “thedarkoverlord” (TDO) claimed to have successfully compromised the systems of H-E Parts Morgan, a manufacturer of components for the mining industry. H-E Parts Morgan has not yet publicly commented on the reported breach; information disclosed to DataBreaches[.]net suggests the company refused TDO’s extortion demands. TDO has made no public announcement via social media in reference to this incident. This deviates from the standard modus operandi of the group, which tends to use Twitter to exert pressure on victims to pay an extortion fee.
Adware compromises supply chain, infects millions of Androids
The new adware family “RottenSys” successfully compromised a supply chain process and has infected almost five million Android devices since 2016. The malware masqueraded as a Wi-Fi service application on the devices, and used special permissions to download malicious components via a dropper. To display advertisements on devices, the attackers used a publicly available Android application virtualization framework. The perpetrators have highly likely accrued significant funds from their campaign; an estimated USD 115,000 has been earned since 12 Mar 2018 alone. As well as malvertising, the attackers appeared to be testing a new botnet using RottenSys’ command-and-control (C2) infrastructure. This botnet could be leased to other threat actors to bolster the attackers’ profits.
DDoS attack hits Russian Central Election Commission website
The website of the Russian Central Election Commission was reportedly hit by a distributed denial of service (DDoS) attack on 18 Mar 2018. The DDoS monitoring service DDoSMon reported the site was targeted using the Memcached amplification technique—a method recently adopted by a variety of threat actors. Attribution for the attack was unknown; no hacktivist or threat groups have claimed responsibility at the time of writing. The objective was almost certainly to cause disruption and degradation of service, as the timing coincided with the 2018 Russian presidential election.
APT-28 adopts new anti-sandbox evasion technique
Researchers at security company Palo Alto identified two attacks, on 12 and 14 Mar 2018, respectively, targeting an unnamed European government agency with an updated version of the “DealersChoice” Flash exploitation framework. The attacks were attributed to “APT-28” (aka Fancy Bear, Sofacy). Spearphishing emails referencing a security conference were sent with a Microsoft Word (.docx) document attached. A newly observed anti-sandbox evasion technique loaded a malicious Flash object only after a user had scrolled to the third page of the document. This ensured human interaction, and evolved from the previous tactic of a Flash object loading immediately upon the document’s opening. APT-28’s continued use of this new evasion technique is highly likely.