Rewterz Threat Alert – APT28 or Sofacy/Fancy Bear Returns With New Malware

Severity

Medium

Analysis Summary

APT28 aka Sofacy or Fancy Bear has recently resurfaced with its Lojax rootkit, as reported by a Twitter handle called blackorbird as well as many others. A variant of the malware is being used in ongoing attacks, hitting targets in the Central Asian nations, as well as diplomatic and foreign affairs organizations.

A few sources including the Kaspersky Lab believe that the malware resembles XTunnel, a tool APT28 used to breach the DNC in 2016. Indicators of Compromise have been retrieved for this APT group and are reported below.

APT28 has targeted governments in Europe and Latin America and is believed to have ties with the Russian government.

Impact

Cyber Intrusion

Indicators of Compromise

URLs

• hxxp[:]//45[.]124[.]132[.]127/action-center/centerforserviceandaction/service-and-action[.]php

Malware Hash (MD5/SHA1/SH256)

• 905ec122329c7b31dec70a180b7d99d5
• c6b26a3aa715d059286a719ac5c364c3
• 2093eff4ad465b615327e2f629ee4d38
• 9158b1d2bdf03b3d316f7e6fa3afb5a6
• 4b22a6f74e6c12bc4810fbee1879273d
• d51d485f98810ab1278df4e41b692761
• 060cfb623ced2eac27a6a6c7e1a110e0

Remediation

Block the threat indicators at their respective controls.