Rewterz Threat Alert – APT-28 FancyBear – Active IOCs

Severity

High

Analysis Summary

APT28 is one of Russia’s longest running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against U.S., countries of the former Soviet Union, Europe, and now, Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government.

Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 perform their attacks using a spoofed website and phishing emails containing links to the said websites. From there, a malware is deployed which are made up of highly obfuscated codes.

Recently, APT 28 (allegedly) has attacked Eastern European countries using Empire and Invoke-Obfuscation.

CVE-2021-40444, the MSHTML Remote Code Execution vulnerability is being used by the threat actors.

Impact

• Information Theft
• Data Exfiltration
• Exposure of Sensitive Data

Indicators of Compromise

Domain Name

• wordkeyvpload[.]net
• wordkeyvpload[.]org
• jimbeam[.]live

IP

• 131[.]153[.]96[.]114
• 185[.]117[.]88[.]19
• 94[.]140[.]112[.]178

MD5

• 8e2f8c95b1919651fcac7293cb704c1c
• abd182f7f7b36e9a1ea9ac210d1899df
• 81de02d6e6fca8e16f2914ebd2176b78
• 0ff09c344fc672880fdb03d429c7bda4
• 578b84715217971fa91ece8674693a8e
• cddc884da0c3b827441920d05e6718fa
• 0ff09c344fc672880fdb03d429c7bda4

SHA-256

• f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4
• 7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a
• 1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40
• f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231

SHA-1

• 2881e4ba949152b2d844e32810911e865d878698
• 44917013cd5c406ac36ee047806ee0fd7e8e85df
• 358868a6976a1758deee01f0d60db4592472b8cb
• 10d02cf4a73b73628c258d69dbd1a400631e0eb9
• ebc46df86929898d0e5fc85d8d1d22b2c61c12a4
• d70161b12428946e710da7c497a0d781e51accc2
• 10d02cf4a73b73628c258d69dbd1a400631e0eb9

URL

• https[:]//wordkeyvpload[.]net/keys/Missions
• https[:]//wordkeyvpload[.]net/keys/parliament_rew[.]xls
• https[:]//wordkeyvpload[.]net/keys/Missions
• https[:]//wordkeyvpload[.]net/keys/TR_comparison[.]xls
• https[:]//wordkeyvpload[.]net/keys/JjnJq3[.]html
• https[:]//wordkeyvpload[.]net/keys/iz7hfD[.]html
• https[:]//wordkeyvpload[.]net/keys/Ari2Rc[.]html
• https[:]//wordkeyvpload[.]net/keys/OD4cNq[.]html
• https[:]//wordkeyvpload[.]net/keys/0YOL4[.]cab
• https[:]//wordkeyvpload[.]net/keys/whmel[.]cab
• https[:]//wordkeyvpload[.]net/keys/D9V5E[.]cab
• https[:]//wordkeyvpload[.]net/keys/update[.]dat
• https[:]//wordkeyvpload[.]org/index[.]jsp
• https[:]//wordkeyvpload[.]org/index[.]php
• https[:]//wordkeyvpload[.]org/news[.]php
• https[:]//wordkeyvpload[.]org/admin/get[.]php
• https[:]//wordkeyvpload[.]org/login/process[.]php

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.