Rewterz Threat Alert – APT-28 FancyBear – Active IOCs

Severity

High

Analysis Summary

APT28 is one of Russia’s longest running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against U.S., countries of the former Soviet Union, Europe, and now, Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government.

Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 perform their attacks using a spoofed website and phishing emails containing links to the said websites. From there, a malware is deployed which are made up of highly obfuscated codes.

Recently, APT 28 (allegedly) has attacked Eastern European countries using Empire and Invoke-Obfuscation.

CVE-2021-40444, the MSHTML Remote Code Execution vulnerability is being used by the threat actors.

Impact

• Information Theft
• Data Exfiltration
• Exposure of Sensitive Data

Indicators of Compromise

Filename

• The modified opening session program 29-1-2022_page-0001 98656456363546 4565546454645 98984938493854 pdf
• [.]exe

MD5

• 1f7c854e05be627776d27370bcdc082c

SHA-256

• 5588f6fab387133c21b06f6248259c64260435898edd61866fad50312c2d3b25

SHA-1

• 02b462b277ce2bd3b8ecccc05481dab62ad0bb87

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.