Rewterz Threat Alert – APT-28 FancyBear – Active IOCs

Severity

High

Analysis Summary

APT28 is one of Russia’s longest-running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against the U.S, countries of the former Soviet Union, Europe, and now Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government. Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 performs their attacks using a spoofed website and phishing emails containing malicious links. 

In Feb 2022, APT 28 (allegedly) attacked Eastern European countries using Empire and Invoke-Obfuscation. The MSHTML Remote Code Execution vulnerability, CVE-2021-40444, that was used by their threat actors

Recently, researchers gathered and examined a luring document that was used to install Graphite malware that was uniquely connected to APT28.

‘The luring document is a PowerPoint file that uses a code execution mechanism to be activated when the user enters presentation mode and moves the mouse. The code execution performs a PowerShell script that downloads and executes a OneDrive dropper. The latter downloads a payload that extracts and injects a new PE (Portable Executable) file into itself, which research revealed to be a variation of the Graphite malware family, which utilises the Microsoft Graph API and OneDrive for C&C communications.’

Impact

• Information Theft
• Data Exfiltration
• Exposure of Sensitive Data

Indicators of Compromise

Domain Name

• 9b5uja[.]am[.]files[.]1drv[.]com
• kdmzlw[.]am[.]files[.]1drv[.]com

MD5

• 21bcb8c94f1ffe5aae1cce21a4acdd31
• c0060c0741833af67121390922c44f91

SHA-256

• 1efa9a6e2c80769be8d10b403fc2a05a6c8803b398e547b9b616f66169f33f3a
• d1bceccf5d2b900a6b601c612346fdb3fa5bb0e2faeefcac3f9c29dc1d74838d

SHA-1

• e8dabc359af124d1e6c0e0dac9877c8d34fced1b
• 622eb93e34445c752eeaa623ef9ac6978e58f2fc

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.