Rewterz Threat Alert – APT-28 FancyBear – Active IOCs

Severity

High

Analysis Summary

APT28 is one of Russia’s longest-running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against the U.S, countries of the former Soviet Union, Europe, and now Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government. Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 performs their attacks using a spoofed website and phishing emails containing malicious links. 

In Feb 2022, APT 28 (allegedly) attacked Eastern European countries using Empire and Invoke-Obfuscation. The MSHTML Remote Code Execution vulnerability, CVE-2021-40444, that was used by their threat actors

Recently, researchers gathered and examined a luring document that was used to install Graphite malware that was uniquely connected to APT28.

‘The luring document is a PowerPoint file that uses a code execution mechanism to be activated when the user enters presentation mode and moves the mouse. The code execution performs a PowerShell script that downloads and executes a OneDrive dropper. The latter downloads a payload that extracts and injects a new PE (Portable Executable) file into itself, which research revealed to be a variation of the Graphite malware family, which utilises the Microsoft Graph API and OneDrive for C&C communications.’

Impact

• Information Theft
• Data Exfiltration
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• eb463a1b960168a16ed788f4c9d1fbd6

SHA-256

• 2d8f73c1f2e5b803ad6716644361c20b51ba49fa79361ef0bc1ae3a735968459

SHA-1

• f6d185220d5d1bcce21195a603fd73b0e9a04220

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.