Rewterz Threat Alert – APT-28 FancyBear – Active IOCs

Severity

High

Analysis Summary

APT28 is one of Russia’s longest-running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against the U.S, countries of the former Soviet Union, Europe, and now Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government. Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 performs their attacks using a spoofed website and phishing emails containing malicious links. 

In Feb 2022, APT 28 (allegedly) attacked Eastern European countries using Empire and Invoke-Obfuscation. The MSHTML Remote Code Execution vulnerability, CVE-2021-40444, that was used by their threat actors

Recently, researchers gathered and examined a luring document that was used to install Graphite malware that was uniquely connected to APT28.

‘The luring document is a PowerPoint file that uses a code execution mechanism to be activated when the user enters presentation mode and moves the mouse. The code execution performs a PowerShell script that downloads and executes a OneDrive dropper. The latter downloads a payload that extracts and injects a new PE (Portable Executable) file into itself, which research revealed to be a variation of the Graphite malware family, which utilises the Microsoft Graph API and OneDrive for C&C communications.’

Impact

• Information Theft
• Data Exfiltration
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• 9a915313d02345e149e6ba566fe85c47
• 2ff3e6c9244ef965295aa60879d1aa6b

SHA-256

• 34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad
• efa5b49bdd086125b2b7d4058d09566f1db5f183c2a6332c597322f85107667a

SHA-1

• 9cd7f14d85814c48be3fbf73891415978a7aa882
• 4c813ad68f2f1da6b2c59d11ad983cfa65e1a187

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.