Article Content As alluded to in our previous blog regarding the Cannon tool, the Sofacy group (AKA Fancy Bear, APT28, STRONTIUM, Pawn Storm, Sednit) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018 The majority of targets were NATO-aligned nation states, although several former USSR nation states were also targeted The attacks primarily deployed variants of the Zebrocy tool, which we have previously analyzed A smaller subset of the delivery documents  delivered Cannon or a Zebrocy Delphi variant as reported by ESET Since we began tracking the use of Zebrocy going back to mid-2015, we have observed a significant increase in frequency of deployment of this tool Compared to other backdoor tools associated with the Sofacy group, the use of Zebrocy in attack campaigns is far more widespread The cluster of activity we detail in this blog revolves primarily around a common author name used in each of the delivery documents: Joohn Our initial sample of interest was the delivery document using the crash list(Lion Air Boeing 737).docx filename, which delivered the Zebrocy tool By leveraging our AutoFocus threat intelligence platform in conjunction with data collected from VirusTotal, we were able to pivot from artifacts discovered in the metadata and behaviors to discover the Cannon tool, as well as a number of additional delivery documents, payloads, and targets The attack vector for all of these attacks appears to be via spear-phishing, using email accounts registered to legitimate email providers instead of spoofed email addresses or previously compromised accounts The delivery documents were functionally all the similar, using the remote template function in Microsoft Word to retrieve a malicious macro from the first stage C2 and ultimately loading and executing an initial payload In all, we intercepted nine weaponized documents spanning from October 17, 2018 through November 15, 2018 all sharing the same Joohn author name and delivering variants of either Zebrocy or Cannon The target radius of our dataset spans four continents, covering government agencies at the federal level all the way to local government agencies We also conducted timeline analysis using the collected data which allowed us to discover how the Sofacy group timed their attacks in the Dear Joohn campaign and also how they may have crafted their attacks using automated tools Attack Details Beginning on October 17, 2018, we collected a total of nine delivery documents sent to a multitude of organizations around the world The targets included a foreign affairs organization in North America, foreign affairs organizations in Europe, as well as government entities in former USSR states We also discovered evidence of possible targeting of local law enforcement agencies around the world, covering North America, Australia, and Europe Our telemetry also showed possible targeting of NGOs, marketing firms, as well as organizations in the medical industry The attack vector of these attacks was all via spear-phishing, using email accounts registered to the free email provider Seznam, a popular web services provider located in the Czech Republic An example can be seen in Figure 1 Figure 1 Example spear-phishing email delivered in Dear Joohn attacks In this campaign, the Sofacy group appears to have relied heavily on filenames to lure victims into launching the weaponized documents Filenames ranged from topics alluding to Brexit, the Lion Air crash, and recent rocket attacks in Israel The full list of filenames we were able to collect can be seen in Table 1 Although the filenames appeared to be highly targeted and pertinent to the victims, the actual lure content of the documents were far more generic as seen in Figure 2 Figure 2 Generic lure image In November 2018, the adversary shifted tactics and began implementing non-generic lure content for their weaponized documents We collected three samples heavily targeting NATO-aligned nation states at this time, using three different lures as seen in Figure 3 Unpacking the document revealed that the unobfuscated image was a screenshot of a cover page regarding a NATO workshop in the targeted nation state The other two documents had very similar lures to each other, presenting garbled text to the target with instructions for the victim on how to properly view the document Interestingly, one of them contained instructions in Russian, which may indicate the intended target was a Russian speaking nation-state Each of these weaponized documents used the same tactic for their attacks Upon opening the document, it leveraged the ability of Microsoft Word to retrieve a remote template to then load a malicious macro document as seen in Figure 4 Most notably, the author name Joohn was used repeatedly in each delivery document Hash Filename Created By Last Modified By Remote Template Location Remote Template Hash   c20e5d56b3
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content As alluded to in our previous blog regarding the Cannon tool, the Sofacy group (AKA Fancy Bear, APT28, STRONTIUM, Pawn Storm, Sednit) has persistently attacked various government and private organizations around the world from mid-October 2018 through mid-November 2018 The majority of targets were NATO-aligned nation states, although several former USSR nation states were also targeted The attacks primarily deployed variants of the Zebrocy tool, which we have previously analyzed A smaller subset of the delivery documents  delivered Cannon or a Zebrocy Delphi variant as reported by ESET Since we began tracking the use of Zebrocy going back to mid-2015, we have observed a significant increase in frequency of deployment of this tool Compared to other backdoor tools associated with the Sofacy group, the use of Zebrocy in attack campaigns is far more widespread The cluster of activity we detail in this blog revolves primarily around a common author name used in each of the delivery documents: Joohn Our initial sample of interest was the delivery document using the crash list(Lion Air Boeing 737).docx filename, which delivered the Zebrocy tool By leveraging our AutoFocus threat intelligence platform in conjunction with data collected from VirusTotal, we were able to pivot from artifacts discovered in the metadata and behaviors to discover the Cannon tool, as well as a number of additional delivery documents, payloads, and targets The attack vector for all of these attacks appears to be via spear-phishing, using email accounts registered to legitimate email providers instead of spoofed email addresses or previously compromised accounts The delivery documents were functionally all the similar, using the remote template function in Microsoft Word to retrieve a malicious macro from the first stage C2 and ultimately loading and executing an initial payload In all, we intercepted nine weaponized documents spanning from October 17, 2018 through November 15, 2018 all sharing the same Joohn author name and delivering variants of either Zebrocy or Cannon The target radius of our dataset spans four continents, covering government agencies at the federal level all the way to local government agencies We also conducted timeline analysis using the collected data which allowed us to discover how the Sofacy group timed their attacks in the Dear Joohn campaign and also how they may have crafted their attacks using automated tools Attack Details Beginning on October 17, 2018, we collected a total of nine delivery documents sent to a multitude of organizations around the world The targets included a foreign affairs organization in North America, foreign affairs organizations in Europe, as well as government entities in former USSR states We also discovered evidence of possible targeting of local law enforcement agencies around the world, covering North America, Australia, and Europe Our telemetry also showed possible targeting of NGOs, marketing firms, as well as organizations in the medical industry The attack vector of these attacks was all via spear-phishing, using email accounts registered to the free email provider Seznam, a popular web services provider located in the Czech Republic An example can be seen in Figure 1 Figure 1 Example spear-phishing email delivered in Dear Joohn attacks In this campaign, the Sofacy group appears to have relied heavily on filenames to lure victims into launching the weaponized documents Filenames ranged from topics alluding to Brexit, the Lion Air crash, and recent rocket attacks in Israel The full list of filenames we were able to collect can be seen in Table 1 Although the filenames appeared to be highly targeted and pertinent to the victims, the actual lure content of the documents were far more generic as seen in Figure 2 Figure 2 Generic lure image In November 2018, the adversary shifted tactics and began implementing non-generic lure content for their weaponized documents We collected three samples heavily targeting NATO-aligned nation states at this time, using three different lures as seen in Figure 3 Unpacking the document revealed that the unobfuscated image was a screenshot of a cover page regarding a NATO workshop in the targeted nation state The other two documents had very similar lures to each other, presenting garbled text to the target with instructions for the victim on how to properly view the document Interestingly, one of them contained instructions in Russian, which may indicate the intended target was a Russian speaking nation-state Each of these weaponized documents used the same tactic for their attacks Upon opening the document, it leveraged the ability of Microsoft Word to retrieve a remote template to then load a malicious macro document as seen in Figure 4 Most notably, the author name Joohn was used repeatedly in each delivery document Hash Filename Created By Last Modified By Remote Template Location Remote Template Hash   c20e5d56b3 ### Response: .