securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.co/wordpress/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.co/wordpress/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * Google blocked the largest Layer 7 DDoS reported to date
 * BlackByte ransomware v2 is out with new extortion novelties
 * Apple fixed two new zero-day flaws exploited by threat actors
 * PoC exploit code for critical Realtek RCE flaw released online
 * China-linked RedAlpha behind multi-year credential theft campaign
 * Bugdrop dropper includes features to circumvent Google's security Controls



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


RUSSIA-LINKED APT29 TARGETS DIPLOMATIC AND GOVERNMENT ORGANIZATIONS

May 2, 2022  By Pierluigi Paganini


Powered by pixfutureⓘ


RUSSIA-LINKED APT29 (COZY BEAR OR NOBELIUM) LAUNCHED A SPEAR-PHISHING CAMPAIGN
TARGETING DIPLOMATS AND GOVERNMENT ENTITIES.

In mid-January 2022, security researchers from Mandiant have spotted a
spear-phishing campaign, launched by the Russia-linked APT29 group, on targeting
diplomats and government entities.

Powered by pixfutureⓘ

The Russia-linked APT29 group (aka SVR, Cozy Bear, and The Dukes) has been
active since at least 2014, along with APT28 cyber espionage group was involved
in the Democratic National Committee hack and the wave of attacks aimed at
the 2016 US Presidential Elections.

The messages used in the recent campaign uncovered by Mandiant, are sent from
compromised email addresses belonging to embassies. The phishing emails
masqueraded as administrative notices related to various embassies. Nation-state
actors used Atlassian Trello, DropBox, and cloud services, as part of their
command and control (C2) infrastructure.

The experts observed multiple waves of attacks between January 2022 and March
2022.



“APT29 targeted large lists of recipients that Mandiant suspected were primarily
publicly listed points of contact of embassy personnel. These phishing emails
utilized a malicious HTML dropper tracked as ROOTSAW, that makes use of a
technique known as HTML smuggling to deliver an IMG or ISO file to a victim
system.” reads the analysis published by Mandiant.

The messages used the HTML smuggling technique to deliver an IMG or ISO file to
the victims.

The ISO image contains a Windows shortcut file (LNK), that executed an embedded
malicious DLL file when clicked. Upon opening the attachment, the ROOTSAW HTML
dropper will write an IMG or ISO file to disk. The image file contains a Windows
shortcut (LNK) file and a malicious DLL. One clicked the LNK file, the malicious
DLL is executed. To trick the victim into clicking the LNK file, attackers used
a fake icon to trick the victim into believing that the file is a legitimate
document file.

Once executed the DLL, the BEATDROP downloader is delivered and executed in
memory.

“BEATDROP is a downloader written in C that makes use of Trello for C2. Once
executed, BEATDROP first maps its own copy of ntdll.dll into memory for the
purpose of executing shellcode in its own process. BEATDROP first creates a
suspended thread with RtlCreateUserThread which points to NtCreateFile.”
continues the report. “Following this, BEATDROP will enumerate the system for
the username, computer name, and IP address. This information is used to create
a victim ID, which is used by BEATDROP to store and retrieve victim payloads
from its C2. Once the victim ID is created, BEATDROP will make an initial
request to Trello to identify whether the current victim has already been
compromised.”

Experts also reported that APT29 replaced BEATDROP with a new C++ BEACON loader
based on Cobalt Strike. The beacon implements backdoor capabilities, including

These capabilities include keylogging, taking screenshot, harvesting account
credentials, exfiltrating data, port scanning, and more.

Once gained a foothold in the target network, APT29 quickly attempt to escalate
privileges, in some cases the attackers were able to gain Domain Admin in less
than 12 hours from the phishing attack.

Once the threat actors have established access, they perform extensive
reconnaissance of hosts and the Active Directory environment. The APT group was
also observed conducting on-host reconnaissance to harvest credentials.

During this phishing campaign, the APT29 group was observed utilizing multiple
malware families, including BEATDROP and BOOMMIC loaders, ROOTSAW dropper HTML
file, and the BEACON backdoor.

The report includes indicators of compromise (IoCs), detection rules, and MITRE
ATT&CK TTPs.

> Please vote for Security Affairs as the best European Cybersecurity Blogger
> Awards 2022 – VOTE FOR YOUR WINNERS
> Vote for me in the sections “The Underdogs – Best Personal (non-commercial)
> Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your
> choice.
> To nominate, please
> visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform
>  

Follow me on Twitter: @securityaffairs and Facebook



Pierluigi Paganini

(SecurityAffairs – hacking, APT)









Powered by pixfutureⓘ





Share this...

Facebook
Twitter
Linkedin


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


APTAPT29CyberespionageHackinghacking newsinformation security newsPierluigi
PaganiniRussiaSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Synology and QNAP warn of critical Netatalk flaws in some of their products

NEXT ARTICLE

IoT and Cybersecurity: What’s the Future?

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


GOOGLE BLOCKED THE LARGEST LAYER 7 DDOS REPORTED TO DATE

August 18, 2022  By Pierluigi Paganini

BLACKBYTE RANSOMWARE V2 IS OUT WITH NEW EXTORTION NOVELTIES

August 18, 2022  By Pierluigi Paganini






 * SPONSORED CONTENT
   
   
 * 


 * PIXFUTURE

 * 


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

SYNOLOGY AND QNAP WARN OF CRITICAL NETATALK FLAWS IN SOME OF THEIR PRODUCTS

Synology warns customers that some of its NAS devices are affected by multiple
critical Netatalk vulnerabilities. Synology...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT