• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Satan Ransomware’s Evolves with New Propagation Techniques
May 23, 2019
Rewterz Threat Advisory – Red Hat update for python27-python and python27-python-jinja2 Multiple Vulnerabilities
May 23, 2019

Rewterz Threat Alert – APT28 or Sofacy/Fancy Bear Returns With New Malware

May 23, 2019

Severity

Medium

Analysis Summary


APT28 aka Sofacy or Fancy Bear has recently resurfaced with its Lojax rootkit, as reported by a Twitter handle called blackorbird as well as many others. A variant of the malware is being used in ongoing attacks, hitting targets in the Central Asian nations, as well as diplomatic and foreign affairs organizations.

A few sources including the Kaspersky Lab believe that the malware resembles XTunnel, a tool APT28 used to breach the DNC in 2016. Indicators of Compromise have been retrieved for this APT group and are reported below.

APT28 has targeted governments in Europe and Latin America and is believed to have ties with the Russian government.

Impact

Cyber Intrusion

Indicators of Compromise

URLs

  • hxxp[:]//45[.]124[.]132[.]127/action-center/centerforserviceandaction/service-and-action[.]php

Malware Hash (MD5/SHA1/SH256)

  • 905ec122329c7b31dec70a180b7d99d5
  • c6b26a3aa715d059286a719ac5c364c3
  • 2093eff4ad465b615327e2f629ee4d38
  • 9158b1d2bdf03b3d316f7e6fa3afb5a6
  • 4b22a6f74e6c12bc4810fbee1879273d
  • d51d485f98810ab1278df4e41b692761
  • 060cfb623ced2eac27a6a6c7e1a110e0

Remediation

Block the threat indicators at their respective controls.

  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.