Poland’s Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29, a state-sponsored hacking group belonging to the Russian government’s Foreign Intelligence Service (SVR), to widespread attacks on NATO and European Union countries.
The group, also known as Cozy Bear and Nobelium, targeted diplomatic entities and foreign ministries in a cyber espionage campaign aimed at harvesting information. The attackers used spear-phishing emails impersonating European embassies, using malicious websites or attachments to deploy malware via ISO, IMG, and ZIP files.
Websites controlled by APT29 infected victims with the EnvyScout dropper via HTML smuggling, which helped deploy downloaders known as SNOWYAMBER and QUARTERRIG, designed to deliver additional malware, as well as a CobaltStrike Beacon stager named HALFRIG.
The malware analysis report revealed that SNOWYAMBER and QUARTERRIG were used for reconnaissance to evaluate each target’s relevance and determine whether they compromised honeypots or VMs used for malware analysis.
Once a workstation was infected, the downloaders were used to deliver and start-up the commercial tools COBALT STRIKE or BRUTE RATEL. HALFRIG was used as a loader that contained the COBALT STRIKE payload and ran it automatically.
APT29 is a hacking division of the Russian Foreign Intelligence Service (SVR), which was also linked to the SolarWinds supply-chain attack that led to the compromise of multiple US federal agencies three years ago. The group has breached other organizations’ networks using stealthy malware that remained undetected for years, including a new malware tracked as TrailBlazer and a variant of the GoldMax Linux backdoor.
In addition, the Brute Ratel adversarial attack simulation tool has been used in attacks suspected to be linked to the Russian SVR cyber spies. Microsoft recently reported that the APT29 hackers are using new malware capable of hijacking Active Directory Federation Services (ADFS) to log in as anyone in Windows systems.
The group has also orchestrated a wave of phishing campaigns targeting governments, embassies, and high-ranking officials across Europe.
