Rewterz Threat Alert – APT-28 FancyBear – Active IOCs

January 27, 2022

Severity

High

Analysis Summary

APT28 is one of Russia’s longest running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against U.S., countries of the former Soviet Union, Europe, and now, Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government.

Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 perform their attacks using a spoofed website and phishing emails containing links to the said websites. From there, a malware is deployed which are made up of highly obfuscated codes.

Recently, APT 28 (allegedly) has attacked Eastern European countries using Empire and Invoke-Obfuscation.

CVE-2021-40444, the MSHTML Remote Code Execution vulnerability is being used by the threat actors.

Impact

Information Theft
Data Exfiltration
Exposure of Sensitive Data

Indicators of Compromise

Domain Name

wordkeyvpload[.]net
wordkeyvpload[.]org
jimbeam[.]live

IP

131[.]153[.]96[.]114
185[.]117[.]88[.]19
94[.]140[.]112[.]178

MD5

8e2f8c95b1919651fcac7293cb704c1c
abd182f7f7b36e9a1ea9ac210d1899df
81de02d6e6fca8e16f2914ebd2176b78
0ff09c344fc672880fdb03d429c7bda4
578b84715217971fa91ece8674693a8e
cddc884da0c3b827441920d05e6718fa
0ff09c344fc672880fdb03d429c7bda4

SHA-256

f007020c74daa0645b181b7b604181613b68d195bd585afd71c3cd5160fb8fc4
7bd11553409d635fe8ad72c5d1c56f77b6be55f1ace4f77f42f6bfb4408f4b3a
1ee602e9b6e4e58dfff0fb8606a41336723169f8d6b4b1b433372bf6573baf40
f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231

SHA-1

2881e4ba949152b2d844e32810911e865d878698
44917013cd5c406ac36ee047806ee0fd7e8e85df
358868a6976a1758deee01f0d60db4592472b8cb
10d02cf4a73b73628c258d69dbd1a400631e0eb9
ebc46df86929898d0e5fc85d8d1d22b2c61c12a4
d70161b12428946e710da7c497a0d781e51accc2
10d02cf4a73b73628c258d69dbd1a400631e0eb9

URL

https[:]//wordkeyvpload[.]net/keys/Missions
https[:]//wordkeyvpload[.]net/keys/parliament_rew[.]xls
https[:]//wordkeyvpload[.]net/keys/Missions
https[:]//wordkeyvpload[.]net/keys/TR_comparison[.]xls
https[:]//wordkeyvpload[.]net/keys/JjnJq3[.]html
https[:]//wordkeyvpload[.]net/keys/iz7hfD[.]html
https[:]//wordkeyvpload[.]net/keys/Ari2Rc[.]html
https[:]//wordkeyvpload[.]net/keys/OD4cNq[.]html
https[:]//wordkeyvpload[.]net/keys/0YOL4[.]cab
https[:]//wordkeyvpload[.]net/keys/whmel[.]cab
https[:]//wordkeyvpload[.]net/keys/D9V5E[.]cab
https[:]//wordkeyvpload[.]net/keys/update[.]dat
https[:]//wordkeyvpload[.]org/index[.]jsp
https[:]//wordkeyvpload[.]org/index[.]php
https[:]//wordkeyvpload[.]org/news[.]php
https[:]//wordkeyvpload[.]org/admin/get[.]php
https[:]//wordkeyvpload[.]org/login/process[.]php

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.