CYBER ARMS – Computer Security

Introduction

When it comes to the clandestine world of cyber warfare, Russian APT (Advanced Persistent Threat) groups are often at the forefront. These digital operatives, shrouded in mystery and often state-sponsored, play a critical role in the geopolitical cyber landscape. In this report, we’ll explore the main Russian APT groups, their targets, operational methods, and a technical analysis of their varied and sophisticated techniques. Finally, we’ll discuss effective defensive strategies to counter these threats.

Russian Hybrid Warfare: The Bigger Picture

Russian APT groups are a critical component of Russia’s broader hybrid warfare strategy, which blends conventional military tactics with cyber operations, disinformation, and other unconventional methods to achieve strategic goals.

Hybrid Warfare Explained

Hybrid warfare is a multifaceted approach that combines military force with cyber attacks, propaganda, economic pressure, and political influence operations. The aim is to create ambiguity and confusion, making it difficult for adversaries to respond effectively.

For example, the annexation of Crimea in 2014 showcased Russia’s hybrid warfare tactics.

This is where conventional military actions were supported by cyber-attacks, information warfare, and the use of “little green men”

Unmarked soldiers who created confusion and uncertainty on the ground.

Role of APT Groups in Hybrid Warfare

Russian APT groups play a vital role in the cyber dimension of hybrid warfare. They conduct cyber espionage, sabotage, and disinformation campaigns to destabilize and influence target nations.

Example: During the 2016 US presidential election, APT28 (Fancy Bear) and APT29 (Cozy Bear) conducted cyber operations to influence the outcome. These groups hacked into political organizations, leaked sensitive information, and spread disinformation, all as part of a broader strategy to sow discord and undermine confidence in democratic processes.

Key Russian APT Groups

Let’s take a look at several of the currently active APT groups. 

APT28 (Fancy Bear)

Who They Are: APT28, also known as Fancy Bear, Sofacy, and STRONTIUM, is one of the most notorious Russian APT groups. Linked to Russia’s General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center military unit 26165, Fancy Bear has been active since at least 2004.

Targets: Government entities, military organizations, security firms, media outlets, and political entities worldwide, particularly in Europe and North America.

Operational Techniques: APT 28 is known for its spear-phishing campaigns, zero-day exploits, and advanced malware.

Technical Analysis:

• Spear-Phishing: APT28 excels in crafting personalized spear-phishing emails that trick victims into opening malicious attachments or links. These emails often mimic legitimate communications, making them highly effective.
• Exploits and Malware: They use a wide range of techniques and tools including ADVSTORESHELL, CHOPSTICK, JHUHUGIT, X-Agent and XTunnel, and numerous droppers in an attempt to steal passwords, collect data, capture screenshots, and log keystrokes. It also uses obfuscation and encrypted communication channels during data exfiltration.
• This APT group used Android malware to target the Ukrainian Army’s Artillery. Allegedly leading to heavy losses of Howitzer D-30 artillery pieces.
• See https://attack.mitre.org/groups/G0007/

APT29 (Cozy Bear)

Who They Are: Cozy Bear, also known as The Dukes, Nobelium and several others, is another heavyweight in the Russian APT arena. Believed to be linked to Russia’s Foreign Intelligence Service (SVR), Cozy Bear has been operating since at least 2008. Well known for the SolarWinds Compromise.

Targets: Primarily targets government institutions, think tanks, research organizations, and businesses, particularly in the United States and Europe.

Operational Techniques: Cozy Bear employs a combination of spear-phishing, credential harvesting, and sophisticated malware.

Technical Analysis:

• Spear-Phishing and Credential Harvesting: Like Fancy Bear, Cozy Bear uses spear-phishing to obtain initial access. Once inside, they focus on credential harvesting to escalate privileges and maintain persistence.
• Custom Malware: They use existing tools, windows commands and custom malware like SUNBURST, SUNSPOT, Raindrop, TEARDROP and the Dukes (MiniDuke, CosmicDuke, OnionDuke, CozyDuke) to perform reconnaissance, data exfiltration, and command execution.
• See https://attack.mitre.org/campaigns/C0024/

APT44 (Sandworm)

Who They Are: APT44, also known as Sandworm, associated with groups such as Iron Viking and FROZENBARENTS. APT44 has been used heavily in coordination with Russian conventional military attacks in Ukraine.

In fact, they are responsible for many of the disruptive cyber operations against Ukraine over the past decade. Linked to Russia’s military intelligence wing, APT44 has been active since as early as 2009.

Targets: APT44 primarily targets businesses, especially those involved in the energy sector, and financial institutions in the United States and Europe.

Operational Techniques: They use a three-prong attack including Espionage, Intrusion and Psychological Influence campaigns, often employing a mix of spear-phishing, malware, and social engineering tactics. Their tactics have evolved over the years from cyber espionage to destructive operations.

Technical Analysis:

• Spear-Phishing: APT44 uses sophisticated spear-phishing campaigns made up of emails with malicious Office documents infected with malicious macros.
• Destructive Malware – They are behind some of the most destructive cyberattacks, including NotPetya and BlackEnergy. NotPetya was malware that contained basically two parts – the NSA’s Eternal Blue tool and Mimikatz. NotPetya was initially intended to damage Ukraine, but raced across the globe and caused an estimated $10 Billion in damages.
• BlackEnergy is a Trojan used to perform DDoS attacks, cyber espionage and destructive information attacks. APT 44 used BlackEnergy to target industrial control systems (ICS) in government, media and energy companies worldwide. It was also used to shut down Ukraine’s power grid in 2015.
• They also used CaddyWiper, a malware tool known for its ability to work alphabetically through target system drive and overwriting all files.
• See https://attack.mitre.org/groups/G0034/

GAMAREDON

Who They Are: GAMAREDON, also known as Trident Ursa, Primitive Bear and Shuckworm, is a cyber espionage group linked to Russian intelligence (FSB Center 18). They have been active since at least 2013 and are known for their persistent and targeted attacks. According to the EU CERT, they are currently the most prolific actor in the Russian war against Ukraine

Targets: GAMAREDON primarily targets Ukrainian government institutions, military organizations, and critical infrastructure.

Operational Techniques: Their operations are characterized by phishing, malware deployment, and sophisticated command and control infrastructure.

Technical Analysis:

• Phishing Campaigns: GAMAREDON employs phishing emails with malicious attachments or links to deliver their malware. These emails are often tailored to the victim’s profile to increase their effectiveness. They use techniques like fast flux DNS and DNS Bypasses to make analysis more difficult.
• Malware: They use a variety of malicious email tactics, including malicious office macros, zipped attachments, GitHub downloads and droppers. These tools allow them to remotely control infected systems and extract valuable information. See https://attack.mitre.org/groups/G0047/

GOSSAMER BEAR

Who They Are: GOSSAMER BEAR is a Russian FSB APT group with a focus on cyber espionage. They have been active since at least 2014 and are known for their sophisticated targeting and malware use.

Targets: GOSSAMER BEAR targets government agencies, military entities, and think tanks, primarily in Europe and the United States, with a focus on Ukraine.

Operational Techniques: Their methods include spear-phishing, malware deployment, and exploiting vulnerabilities in software.

Technical Analysis:

• Spear-Phishing and Exploits: GOSSAMER BEAR uses well-crafted spear-phishing emails to deliver malware. They often exploit zero-day vulnerabilities to gain initial access to networks.
• Advanced Malware: GOSSAMER uses tools designed for data exfiltration, remote control, and system manipulation, allowing them to maintain a persistent presence on targeted networks.

How They Function: The Anatomy of a Russian APT Operation

Russian APT operations are characterized by their meticulous planning, resourcefulness, and adaptability. Sometimes they are used alongside kinetic attacks as seen in Ukraine and other Countries. Sometimes they are used in retaliation attacks (Ex. In response to Sanctions).

Sometimes they are used in espionage or influence campaigns. They usages can very, but many times their techniques and procedures are the same. Let’s break down the general modus operandi of these groups.

Initial Access

Spear-phishing remains the go-to method. By sending emails that appear legitimate, attackers trick targets into downloading malicious attachments or clicking on harmful links.

Establishing Foothold

After gaining initial access, APT groups establish a foothold by deploying malware and backdoors.

Command and Control (C2)

Secure communication channels are set up between the compromised systems and the attackers’ command and control servers.

Lateral Movement

Attackers move laterally within the network to compromise additional systems and gather more intelligence.

Data Exfiltration

Data is collected and exfiltrated from the target network back to the attackers.

Covering Tracks

Advanced APT groups employ various methods to cover their tracks, making it difficult for defenders to trace their activities.

Defensive Strategies: Building a Strong Cyber Defense

Understanding how these APT groups operate is the first step in defending against them. As many of their attacks are standard phishing or common direct attacks, standard defensive strategies are a good tactic for securing against these threats. Here are some practical strategies to bolster your cyber defenses.

Comprehensive Threat Intelligence

Strategy: Invest in a robust threat intelligence program to stay ahead of emerging threats.

Implementation: Regularly update threat databases with the latest indicators of compromise (IOCs) and share intelligence with other organizations to build a collaborative defense.

Multi-Factor Authentication (MFA)

Strategy: Implement MFA to add an extra layer of security, making it more difficult for attackers to gain unauthorized access.

Implementation: Require MFA for all user accounts, especially those with administrative privileges, and ensure that MFA methods are robust and secure.

Network Segmentation

Strategy: Divide the network into smaller, isolated segments to limit the spread of malware and unauthorized access.

Implementation: Use VLANs, firewalls, and access controls to enforce segmentation, ensuring that critical systems and sensitive data are protected.

Endpoint Protection

Strategy: Deploy advanced endpoint protection solutions to detect and prevent malware infections.

Implementation: Don’t trust in just anti-virus alone, intelligence security products are much better at detecting and stopping advanced attacks. Use Next Generation Firewalls (NGFWs), anti-malware, endpoint detection and response (EDR) tools to monitor and protect endpoints from sophisticated threats.

Regular Security Audits

Strategy: Conduct regular security audits and penetration testing to identify and address vulnerabilities.

Implementation: Engage third-party security experts to perform thorough assessments and provide recommendations for improving security posture.

User Training and Awareness

Strategy: Educate users about cybersecurity best practices and the dangers of phishing.

Implementation: Regularly conduct training sessions and phishing simulations to keep employees vigilant and aware of potential threats.

Conclusion

Russian APT groups are sophisticated, persistent, and deeply intertwined with the nation’s broader hybrid warfare strategy. By understanding their tactics and implementing robust defensive measures, organizations can better protect themselves against these formidable adversaries. In the ever-evolving landscape of cyber warfare, vigilance and preparedness are key to staying one step ahead in the digital shadows.

Sources

https://flashpoint.io/blog/russian-apt-groups-cyber-threats/

https://attack.mitre.org/groups/

https://home.treasury.gov/news/press-releases/jy1962

https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/

https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf