Article Content Summary The Sofacy group remains a persistent global threat Unit 42 and others have shown in the first half of 2018 how this threat actor group continues to target multiple organizations throughout the world with a strong emphasis on government, diplomatic and other strategic organizations primarily in North America and Europe Following up our most recent Sofacy research in February and March of 2018, we have found a new campaign that uses a lesser known tool widely attributed to the Sofacy group called Zebrocy This third campaign is consistent with two previously reported attack campaigns in terms of targeting: the targets were government organizations dealing with foreign affairs In this case however the targets were in different geopolitical regions An interesting difference we found in this newest campaign was that the attacks using Zebrocy cast a far wider net within the target organization: the attackers sent phishing emails to a an exponentially larger number of individuals The targeted individuals did not follow any significant pattern, and the email addresses were found easily using web search engines This is a stark contrast with other attacks commonly associated with the Sofacy group where generally no more than a handful of victims are targeted within a single organization in a focus-fire style of attack In addition to the large number of Zebrocy attacks we discovered, we also observed instances of the Sofacy group leveraging the Dynamic Data Exchange (DDE) exploit technique previously documented by McAfee The instances we observed, however, used the DDE exploit to deliver different payloads than what was observed previously In one instance the DDE attack was used to deliver and install Zebrocy In another instance, the DDE attack was used to deliver an open-source penetration testing toolkit called Koadic The Sofacy group has leveraged open source or freely available tools and exploits in the past but this is the first time that Unit 42 has observed them leveraging the Koadic toolkit Links to previous attacks In our February report, we discovered the Sofacy group using Microsoft Office documents with malicious macros to deliver the SofacyCarberp payload to multiple government entities In that report, we documented our observation that the Sofacy group appeared to use conventional obfuscation techniques to mask their infrastructure attribution by using random registrant and service provider information for each of their attacks In particular, we noted that the Sofacy group deployed a webpage on each of the domains This is odd because attackers almost never set up an actual webpage on adversary C2 infrastructure Even stranger, each webpage contained the same content within the body Since that report, we continued our research into this oddity Using this artifact, we were able to pivot and discover another attack campaign using the DealersChoice exploit kit with similar victimology to what we saw in February Continuing to use this artifact, we discovered another domain with the same content body, supservermgr[.]com This domain was registered on December 20, 2017 and within a few days was resolving to 92.222.136[.]105, which belonged to a well-known VPS provider often used by the Sofacy group Unfortunately, at the time of collection, the C2 domain had been sinkholed by a third party First, we determined the sample we collected, d697160ae… was attempting to communicate to its C2 at hxxp://supservermgr[.]com/sys/upd/pageupd.php to retrieve a Zebrocy AutoIT downloader Because the domain had been sinkholed, this activity could not be completed This led us to additional infrastructure for Zebrocy at 185.25.51[.]198 and 185.25.50[.]93 At this point we had collected nearly thirty samples of Zebrocy in relation to the original sample and its associated C2 domain Additional pivoting based on artifacts unique to this malware family expanded our dataset to hundreds of samples used over the last several years Most of the additional samples were the Delphi and AutoIT variants as reported by ESET However, several of the collected samples were a C++ variant of the Zebrocy downloader tool In addition, we discovered evidence of a completely different payload in Koadic being delivered as well Also, we found the IP address 185.25.50[.]93 hosting C2 services for a Delphi backdoor that ESET’s report states is the final stage payload for these attacks A Maltego chart diagramming the relational analysis we performed is below:  Figure 1 Visualization of relationships Please note this is not a comprehensive chart of all Zebrocy and Koadic samples we were able to collect Only samples mentioned or relevant to the relational analysis have been included Pivoting off of this artifact provided us additional Zebrocy samples A closer examination of the tool revealed the second user agent string was from a secondary payload that was retrieved by the cba5ab65a… sample Pivoting from the Mozilla v5.1 user agent revealed over forty additional Zebrocy samples, with several again targeting the same Central Asian nation Two samples specifically, 25f0d1cbc… and 115fd8c61… provided additional artifacts we were able to pivot from to discover weaponized documents to deliver Zebrocy as well as a Koadic Figure 2 Timeline of User Agents DDE Documents The two weaponized documents we discovered leveraging DDE were of particular interest due to victimology and a change in tactics While examining 25f0d1cbc…, we were able to pivot from its C2  220.158.216[.]127 to gather additional Zebrocy samples as well as a weaponized document This document (85da72c7d…) appears to have been targeting a North American government organization dealing with foreign affairs It leveraged DDE to retrieve and install a payload onto the victim host A decoy document is deployed in this attack, with the contents purporting be a publicly available document from the United Nations regarding the Republic of Uzbekistan Figure 3 Example of delivery document  Figure 4 Lure image used The creator of the weaponized document appended their DDE instructions to the end of the document after all of the decoy contents When the document is opened in Word, the instructions are not immediately visible, as Word does not display these fields contents by default As you can see in the following screenshot, simply attempting to highlight the lines in which the DDE instructions reside does not display them Figure 5 Hidden DDE commands Enabling the “Toggle Field Codes” feature reveals the DDE instructions to us and shows that the author had set instructions to size 1 font and with a white coloring The use of a white font coloring to hide contents within a weaponized document is a technique we had previously reported being used by the Sofacy group in a malicious macro attack The DDE instructions also included another command that it did not run, which suggests it is an artifact of a prior version of this delivery document 115fd8c61… was another Zebrocy sample we were able to pivot from by gathering additional samples connecting to its C2 86.106.131[.]177 The additional samples targeted the same large Central Asian nation state as previously mentioned but more interestingly, one of the samples was a weaponized document also leveraging DDE and containing a non-Zebrocy payload The payload turned out to be an open source penetration test toolkit called Koadic It is a toolkit similar to Metasploit or PowerShell Empire and is freely available to anyone on Github Conclusion The Sofacy group continues their targeted attack campaigns in 2018 As mentioned in this blog, Sofacy is carrying out parallel campaigns to attack similar targets around the world but with different toolsets The Zebrocy tool associated with this current strain of attacks is constructed in several different forms based on the programming language the developer chose to create the tool We have observed Delphi, AutoIt, and C++ variants of Zebrocy, all of which are related not only in their functionality, but also at times by chaining the variants together in a single attack These attacks are still largely perpetrated via spear phishing campaigns, whether via simple executable attachments in hopes that a victim will launch the file to using a previously observed DDE exploitation technique Palo Alto Networks customers are protected from Zebrocy and Koadic attacks by:  All known Zebrocy samples have a malicious verdict in WildFire AutoFocus customers can track this campaign with the following Tags:  Zebrocy Koadic    Appendix Zebrocy C++ Variant On February 19, 2018, we saw a spear phishing email sent to a foreign affairs organization within a Central Asian country, which attempted to delivered an attached Zebrocy downloader (5b5e80f63…) written in the Delphi programming language This downloader obtained a second downloader, which in this case was very similar in functionality but was written in C++ instead of Delphi It then creates an invisible window (0x0 pixel) in the bottom right corner of the screen, which will call the main function of the Trojan It starts by calling this specific sub-function with an argument of 1 to get the IP address for the C2 to connect The main function then calls the subfunction with the argument 3 to get the POST data parameter (“porg”) along with the volume serial number and computer name and will send this data to the C2 via the HTTP POST request -1 – Deletes the buffer and exits the Trojan 009 – Deletes the buffers and exits the Trojan If neither of the above values are found at the beginning of the HTTP response, the Trojan checks the C2 response for the ASCII representation of hexadecimal bytes First, the DDE instructions heavily rely on the QUOTE field, which converts decimal values to their ASCII equivalent character Also, the author capitalized the “E” in the “dde” command to evade case sensitive signatures Lastly, the author bolded the “dd” characters within the “dde” command, which breaks the string up within the XML of the DOCX file (word/document.xml) to make signature development difficult, as seen here:      123456789101112131415161718  <w:r w:rsidRPr="00E84CED">  <w:rPr>    <w:b/>    <w:noProof/>    <w:color w:themeColor="background1" w:val="FFFFFF"/>    <w:sz w:val="2"/>    <w:szCs w:val="2"/>  </w:rPr>  <w:instrText>dd</w:instrText></w:r><w:r w:rsidRPr="00E84CED">  <w:rPr>    <w:color w:themeColor="background1" w:val="FFFFFF"/>    <w:sz w:val="2"/>    <w:szCs w:val="2"/>  </w:rPr>  <w:instrText xml:space="preserve">E </w:instrText></w:r>     In addition to the aforementioned DOCX file, we found another related DDE enabled document  based on an infrastructure overlap with a Zebrocy C2 IP address This related delivery document was an RTF file that downloaded and installed a payload used to load the open-source Koadic tool We do not have telemetry on the target or attack vector, but we know the RTF file used DDE to download and execute an executable that loaded Koadic Our analysis shows some possible ties to the Vbs to Exe tool by F2KO Software but we have yet to confirm a direct overlap Unfortunately, we did not observe the Koadic modules used by Sofacy during out analysis
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Summary The Sofacy group remains a persistent global threat Unit 42 and others have shown in the first half of 2018 how this threat actor group continues to target multiple organizations throughout the world with a strong emphasis on government, diplomatic and other strategic organizations primarily in North America and Europe Following up our most recent Sofacy research in February and March of 2018, we have found a new campaign that uses a lesser known tool widely attributed to the Sofacy group called Zebrocy This third campaign is consistent with two previously reported attack campaigns in terms of targeting: the targets were government organizations dealing with foreign affairs In this case however the targets were in different geopolitical regions An interesting difference we found in this newest campaign was that the attacks using Zebrocy cast a far wider net within the target organization: the attackers sent phishing emails to a an exponentially larger number of individuals The targeted individuals did not follow any significant pattern, and the email addresses were found easily using web search engines This is a stark contrast with other attacks commonly associated with the Sofacy group where generally no more than a handful of victims are targeted within a single organization in a focus-fire style of attack In addition to the large number of Zebrocy attacks we discovered, we also observed instances of the Sofacy group leveraging the Dynamic Data Exchange (DDE) exploit technique previously documented by McAfee The instances we observed, however, used the DDE exploit to deliver different payloads than what was observed previously In one instance the DDE attack was used to deliver and install Zebrocy In another instance, the DDE attack was used to deliver an open-source penetration testing toolkit called Koadic The Sofacy group has leveraged open source or freely available tools and exploits in the past but this is the first time that Unit 42 has observed them leveraging the Koadic toolkit Links to previous attacks In our February report, we discovered the Sofacy group using Microsoft Office documents with malicious macros to deliver the SofacyCarberp payload to multiple government entities In that report, we documented our observation that the Sofacy group appeared to use conventional obfuscation techniques to mask their infrastructure attribution by using random registrant and service provider information for each of their attacks In particular, we noted that the Sofacy group deployed a webpage on each of the domains This is odd because attackers almost never set up an actual webpage on adversary C2 infrastructure Even stranger, each webpage contained the same content within the body Since that report, we continued our research into this oddity Using this artifact, we were able to pivot and discover another attack campaign using the DealersChoice exploit kit with similar victimology to what we saw in February Continuing to use this artifact, we discovered another domain with the same content body, supservermgr[.]com This domain was registered on December 20, 2017 and within a few days was resolving to 92.222.136[.]105, which belonged to a well-known VPS provider often used by the Sofacy group Unfortunately, at the time of collection, the C2 domain had been sinkholed by a third party First, we determined the sample we collected, d697160ae… was attempting to communicate to its C2 at hxxp://supservermgr[.]com/sys/upd/pageupd.php to retrieve a Zebrocy AutoIT downloader Because the domain had been sinkholed, this activity could not be completed This led us to additional infrastructure for Zebrocy at 185.25.51[.]198 and 185.25.50[.]93 At this point we had collected nearly thirty samples of Zebrocy in relation to the original sample and its associated C2 domain Additional pivoting based on artifacts unique to this malware family expanded our dataset to hundreds of samples used over the last several years Most of the additional samples were the Delphi and AutoIT variants as reported by ESET However, several of the collected samples were a C++ variant of the Zebrocy downloader tool In addition, we discovered evidence of a completely different payload in Koadic being delivered as well Also, we found the IP address 185.25.50[.]93 hosting C2 services for a Delphi backdoor that ESET’s report states is the final stage payload for these attacks A Maltego chart diagramming the relational analysis we performed is below:  Figure 1 Visualization of relationships Please note this is not a comprehensive chart of all Zebrocy and Koadic samples we were able to collect Only samples mentioned or relevant to the relational analysis have been included Pivoting off of this artifact provided us additional Zebrocy samples A closer examination of the tool revealed the second user agent string was from a secondary payload that was retrieved by the cba5ab65a… sample Pivoting from the Mozilla v5.1 user agent revealed over forty additional Zebrocy samples, with several again targeting the same Central Asian nation Two samples specifically, 25f0d1cbc… and 115fd8c61… provided additional artifacts we were able to pivot from to discover weaponized documents to deliver Zebrocy as well as a Koadic Figure 2 Timeline of User Agents DDE Documents The two weaponized documents we discovered leveraging DDE were of particular interest due to victimology and a change in tactics While examining 25f0d1cbc…, we were able to pivot from its C2  220.158.216[.]127 to gather additional Zebrocy samples as well as a weaponized document This document (85da72c7d…) appears to have been targeting a North American government organization dealing with foreign affairs It leveraged DDE to retrieve and install a payload onto the victim host A decoy document is deployed in this attack, with the contents purporting be a publicly available document from the United Nations regarding the Republic of Uzbekistan Figure 3 Example of delivery document  Figure 4 Lure image used The creator of the weaponized document appended their DDE instructions to the end of the document after all of the decoy contents When the document is opened in Word, the instructions are not immediately visible, as Word does not display these fields contents by default As you can see in the following screenshot, simply attempting to highlight the lines in which the DDE instructions reside does not display them Figure 5 Hidden DDE commands Enabling the “Toggle Field Codes” feature reveals the DDE instructions to us and shows that the author had set instructions to size 1 font and with a white coloring The use of a white font coloring to hide contents within a weaponized document is a technique we had previously reported being used by the Sofacy group in a malicious macro attack The DDE instructions also included another command that it did not run, which suggests it is an artifact of a prior version of this delivery document 115fd8c61… was another Zebrocy sample we were able to pivot from by gathering additional samples connecting to its C2 86.106.131[.]177 The additional samples targeted the same large Central Asian nation state as previously mentioned but more interestingly, one of the samples was a weaponized document also leveraging DDE and containing a non-Zebrocy payload The payload turned out to be an open source penetration test toolkit called Koadic It is a toolkit similar to Metasploit or PowerShell Empire and is freely available to anyone on Github Conclusion The Sofacy group continues their targeted attack campaigns in 2018 As mentioned in this blog, Sofacy is carrying out parallel campaigns to attack similar targets around the world but with different toolsets The Zebrocy tool associated with this current strain of attacks is constructed in several different forms based on the programming language the developer chose to create the tool We have observed Delphi, AutoIt, and C++ variants of Zebrocy, all of which are related not only in their functionality, but also at times by chaining the variants together in a single attack These attacks are still largely perpetrated via spear phishing campaigns, whether via simple executable attachments in hopes that a victim will launch the file to using a previously observed DDE exploitation technique Palo Alto Networks customers are protected from Zebrocy and Koadic attacks by:  All known Zebrocy samples have a malicious verdict in WildFire AutoFocus customers can track this campaign with the following Tags:  Zebrocy Koadic    Appendix Zebrocy C++ Variant On February 19, 2018, we saw a spear phishing email sent to a foreign affairs organization within a Central Asian country, which attempted to delivered an attached Zebrocy downloader (5b5e80f63…) written in the Delphi programming language This downloader obtained a second downloader, which in this case was very similar in functionality but was written in C++ instead of Delphi It then creates an invisible window (0x0 pixel) in the bottom right corner of the screen, which will call the main function of the Trojan It starts by calling this specific sub-function with an argument of 1 to get the IP address for the C2 to connect The main function then calls the subfunction with the argument 3 to get the POST data parameter (“porg”) along with the volume serial number and computer name and will send this data to the C2 via the HTTP POST request -1 – Deletes the buffer and exits the Trojan 009 – Deletes the buffers and exits the Trojan If neither of the above values are found at the beginning of the HTTP response, the Trojan checks the C2 response for the ASCII representation of hexadecimal bytes First, the DDE instructions heavily rely on the QUOTE field, which converts decimal values to their ASCII equivalent character Also, the author capitalized the “E” in the “dde” command to evade case sensitive signatures Lastly, the author bolded the “dd” characters within the “dde” command, which breaks the string up within the XML of the DOCX file (word/document.xml) to make signature development difficult, as seen here:      123456789101112131415161718  <w:r w:rsidRPr="00E84CED">  <w:rPr>    <w:b/>    <w:noProof/>    <w:color w:themeColor="background1" w:val="FFFFFF"/>    <w:sz w:val="2"/>    <w:szCs w:val="2"/>  </w:rPr>  <w:instrText>dd</w:instrText></w:r><w:r w:rsidRPr="00E84CED">  <w:rPr>    <w:color w:themeColor="background1" w:val="FFFFFF"/>    <w:sz w:val="2"/>    <w:szCs w:val="2"/>  </w:rPr>  <w:instrText xml:space="preserve">E </w:instrText></w:r>     In addition to the aforementioned DOCX file, we found another related DDE enabled document  based on an infrastructure overlap with a Zebrocy C2 IP address This related delivery document was an RTF file that downloaded and installed a payload used to load the open-source Koadic tool We do not have telemetry on the target or attack vector, but we know the RTF file used DDE to download and execute an executable that loaded Koadic Our analysis shows some possible ties to the Vbs to Exe tool by F2KO Software but we have yet to confirm a direct overlap Unfortunately, we did not observe the Koadic modules used by Sofacy during out analysis ### Response: .