Pages

24 November 2014

Breaking the Code on Russian Malware

by Jennifer Darche 
November 20, 2014

Russia poses a serious cyber threat to industrial control systems (ICS), pharmaceutical, defense, aviation, and petroleum companies. Russian government cyber operations aim to use malware to steal information on files, persist on ICS equipment, and commit espionage. According to a 2014 GData Red Paper, Uroburos malware’s “modular structure allows extending it with new features easily, which makes it not only highly sophisticated but also highly flexible and dangerous.” Understanding these threats posed by the malware and Russia’s objectives will go a long way to securing networks.

There is nothing quick about studying Russian cyber operations. Beyond understanding the complexities of the malware itself, one must also match up the names of several families of malware, some which have evolved over time and have had different names, as well as to link together the names given to specific groups by a number of private security companies. As many as five different codewords have been given to Russian Federation sponsored cyber campaigns by companies such as Kaspersky, iSIGHT Partners, Symantec, FireEye/Mandiant.

To further complicate research and analysis, the codewords represent different facets of the malware problem, some are grouped by signatures, some by actors, others by tools. Before understanding the cyber threat posed by Russia one must make sense of the tremendous amount of documentation on the problem and connect the codewords to unlock potentially missed data and trends when conducting threat analysis.

Malware rooted in Russia has been attacking a variety of political, military, and economic targets for a least the past seven years.

CLICK IMAGE FOR LARGER VIEW

Russian Malware Analysis

There are primarily three families of Russian malware: Uroburos, Energetic Bear, and APT28. This analysis will lay out the various names given to these threats by the security community as well as provide the malware’s access delivery mechanism, such as spear-phishing and watering hole attacks. Additionally, each group has its unique access vector, exploit/vulnerability, and toolkit.

In examining each in combination it appears each Russian malware group has been designed with different cyber objectives in mind. The three goals include using cyber intrusions to conduct espionage, pre-position Russian accesses for future cyber warfare, and to meddle and monitor geopolitical threat’s in Russia’s backyard. Behind the scenes these goals may provide clues into the organizations and actors that conduct these nefarious attacks.
Uroburos Malware

IDENTIFIERS 

Epic Turla – Kaspersky Labs 

Uroburos – G Data Software AG 

Snake – BAE Systems 

SnakeNet 

TARGETS 

Governments 


Embassies 


Defense Industry 


Research and Education 


Pharmaceutical Industry 

ACCESS DELIVERY 

Spear Phishing 

Watering Hole Attacks 

ACCESS VECTOR 
CVE-2013-5065 
CVE-2013-3346 
CVE-2012-1723 
.SCR Files (some RAR packed) 

Fake “Flash Player” installations via watering holes 

TOOLS 
Agent.BTZ – Agent.AWF/muxbde40.dll 

Epic Turla – Stage 1 Backdoor 

Cobra Carbon System – Intermediary Upgrades – Stage 2 

Snake Uroburos – Sophisticated Platform: Rootkit and Virtual File System – Stage 3 

Zagruzchik.dll 

Cobra/Carbon/Pfinet 

WorldCupSec/TadjMakhal/Wipbot/Tavdig 



The earliest reported attacks involved Agent.BTZ malware intrusion into DoD networks in 2008.

CLICK IMAGE FOR LARGER VIEW

Since that time, Agent.BTZ evolved into Uroburos. According to the aforementioned G Data 2014 Red Paper, “Due to many technical details (file name, encryption keys, behavior and more details mentioned in this report), we assume that the group behind Uroburos is the same group that performed a cyber attack against the United States of America in 2008 with a malware called Agent.BTZ. Uroburos checks for the presence of Agent.BTZ and remains inactive if it is installed.” Based on the targets of this malware, both political and economic espionage seem to be at the root of the Uroburos attackers.

A targeted user receives an email with an attachment containing an executable RAR self-extracting archive (SFX). After opening the executable with an .SCR extension, the RAR SFX archive unpacks the malware and installs it into the appropriate location and then runs the malware. This attack relies heavily on user deception, not technical sophistication. Russian operators likely have had to resort to the .SCR exploitation option when they have lacked usable available exploits (i.e. when exploits have been patched).
Energetic Bear Malware

IDENTIFIERS 
Energetic Bear – CrowdStrike 

Crouching Yeti – Kaspersky Labs 

Koala Team – iSIGHT Partners 

Dragonfly – Symantec 

TARGETS 

Aviation Industry 

Defense Industry 

Energy Industry 

ICS Equipment Manufacturers 

Petroleum Pipeline Operators 

ACCESS DELIVERY 

Spear Phishing 

Watering Hole Attacks 

ACCESS VECTOR 

LightsOut Exploit Kit 

Hello Exploit Kit 

TOOLS 

Backdoor.Oldrea 

Trojan.Karagany 

Energetic Bear RAT 

Havex 



CLICK IMAGE FOR LARGER VIEW


The Energetic Bear group is unique in that its target objective is to maintain long-term persistent access to the energy industry, ICS manufacturers, aviation, and defense. This is further evident by Energetic Bear’s focus on ICS manufacturers and not just deployed ICS assets. This may be the work of a military group pre-positioning itself for a computer network attack as a tool to fulfill military or political goals. Parallels can be drawn between Energetic Bear and Stuxnet in terms of its victimology and focus on ICS equipment.
APT28 Malware

IDENTIFIERS 
Tsar Team/Group – iSIGHT Partners 

Sednit – ESET 

APT28 – Mandiant 

Fancy Bear – CrowdStrike 

Operation Pawn Storm – Trend Micro 

ACCESS DELIVERY 

Spear Phishing 


ACCESS VECTOR 

CVE-2010-3333 

CVE-2012-0158 

CVE-2014-1761 

CVE-2013-1347 

CVE-2013-3897 

CVE-2014-1776 

TOOLS 

Sofacy 

Win32/Sednit 

SOURFACE – netids.dll 

OLDBAIT 

CHOPSTICK 

CORESHELL – coreshell.dll 

EVILTOSS 

TARGETS 

Eastern Europe Government and Military Institutions (Georgia) 

Defense Industry 

Direct Theater-Specific Threats to Russia 

CLICK IMAGE FOR LARGER VIEW

As far back as 2007, APT28 has been targeting Eastern European organizations that appear to be a direct threat to the current Russian government. According to AlienVault, this group “uses phishing campaigns to redirect victims to Outlook Web Access (OWA) portals designed to impersonate the legitimate OWA site of the victim’s company.” APT28 has also focused on intrusions into Georgia’s Ministry of Defense further exemplifying their focus on regional geopolitical threats.

Conclusions

Russia’s three major malware groups each have distinct operational objectives. From espionage, cyber warfare, and tracking regional geopolitical foes, Russia continues to build a cyber capability with the potential to impact organizations worldwide. The scope of Russian cyber operations has only recently been discovered by cyber security firms. In contrast, Chinese cyber operations have been known for over a decade due to their sloppy operational procedures and direct attribution. Russia however, continues to lead the way in stealthier malware and operations making their efforts harder to identify and analyze.

Although these intrusions have been identified and are widely attributed to Russia’s government, there are several others whose attribution to the Russian Federation is less clear like MiniDuke, CosmicDuke, BlackEnergy Bot, Sandworm, and Quedagh.

Each of these groups have disparate targets despite using similar delivery mechanisms. While all of these intrusions utilize user behavior in order to facilitate access to their victims, the varying objectives of each group indicates a strategic level of planning. Furthermore, the lack of cohabitation of the different malware families in the wild is notable. This indicates coordination at the tactical, operational, and strategic level. This kind of coordination is indicative of Russia’s well-known reputation as an advanced cyber threat.
If you’re interested in researching malware using threat intelligence from the open web, we can help. Get started by requesting a demo of Recorded Future.

No comments:

Post a Comment