Article Content Introduction The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments There have been numerous reports on their activities, to the extent that a Wikipedia entry has even been created for them The Linux malware Fysbis is a preferred tool of Sofacy, and though it is not particularly sophisticated, Linux security in general is still a maturing area, especially in regards to malware In short, it is entirely plausible that this tool has contributed to the success of associated attacks by this group This blog post focuses specifically on this Linux tool preferred by Sofacy and describes considerations and implications when it comes to Linux malware Malware Assessment Fysbis is a modular Linux trojan / backdoor that implements plug-in and controller modules as distinct classes For reference, some vendors categorize this malware under the Sednit attacker group naming designation This malware includes both 32-bit and 64-bit versions of Executable and Linking Format (ELF) binaries Additionally, Fysbis can install itself to a victim system with or without root privileges This increases the options available to an adversary when it comes to selecting accounts for installation They epitomize the grudging reality that Advanced Persistent Threat (APT) actors often don’t require advanced means to affect their objectives Rather, these actors more often than not hold their advanced malware and zero day exploits in reserve and employ just enough resources to meet their goals It is only fair that defenders use any shortcuts or tricks at their disposal to shorten the amount of time it takes to assess threats In other words, defenders should always look for ways to work smarter before they have to work harder Getting the Most Out of Strings Binary strings alone revealed a good amount about these files, increasing the efficacy of activities such as static analysis categorization (e.g., Yara) One example of this is Fysbis installation and platform targeting information for the samples in Table 1 and Table 2 Figure 1: Sofacy Fysbis installation and platform targeting found in strings In this case, we can see the binary installation path and local reconnaissance to determine which flavor of Linux the malware is running Another example of easily obtained information from these samples is capability based In addition to contributing to static analysis detections, this can be useful as a starting point for further incident response prioritization and qualification of the threat Symbolic Information Can Shorten Analysis Time Interestingly, the most recent ELF 64-bit binary we analyzed (Table 3) was not stripped prior to delivery, which offered additional context in the form of symbolic information Defenders more familiar with Windows Portable Executable (PE) binaries can equate this with compilation of a Debug version versus a Release version Additionally, this latest sample demonstrated minor evolution of the threat, most notably in terms of obfuscation Specifically, both samples in Table 1 and Table 2 leaked installation information in the clear within binary strings This was not the case with the sample in Table 3 Taking a closer look at this non-stripped binary using a disassembler, the following corresponds to decoding malware installation information for a root-privilege account Figure 5: Assembly code view of Sample 3 installation decoding In this case, the symbolic information hints at the method used for decoding, with references to mask, path, name, and info byte arrays Corresponding INSTALLUSER byte arrays exist, which facilitate the non-root installation for the trojan The same masking method is also used by the binary to decode malware configuration C2 information, further showcasing how a little symbolic information can go a long way towards completeness and higher confidence in assessment of a malware sample If you would like to learn more about how Fysbis works, the samples analyzed remain fairly consistent with the sample analysis found here Infrastructure Analysis As Unit 42 has discussed in depth in other blog articles, we have observed that adversaries in general are seemingly hesitant in changing their infrastructure This may be due to not wanting to commit additional resources, or simply a matter of retaining familiarity for the sake of timeliness In either case, we see the same type of behavior here with the Fysbis samples in use by Sofacy The oldest sample (Table 1), was found to beacon to the domain azureon-line[.]com, which had already been widely publicized as a known command and control domain for the Sofacy group Using passive DNS, we can see that two of the original IPs this domain resolved to, 193.169.244[.]190 and 111.90.148[.]148 also mapped to a number of other domains that had been in use by the Sofacy group during that time period Figure 7: Sample 1 C2 resolutions The first of the newer samples (Table 2), continues the trend and beacons to an IP also widely associated with the Sofacy group, 198.105.125[.]74 This IP has been mostly associated with the tool specifically known as CHOPSTICK, which can be read about here Figure 8: Sample 2 C2 resolutions The newest sample (Table 3), introduces a previously unknown command and control beacon to mozilla-plugins[.]com This activity aligns with the previously observed Sofacy group tactic of integrating legitimate company references into their infrastructure naming convention Comparing this sample’s binary with the other two however, shows there are significant similarities on the code level as well as in terms of shared behavior Figure 9: Sample 3 C2 resolutions Conclusion Linux is used across business and home environments and appears in a variety of form factors Linux is also at the foundation of Android devices and a number of other embedded systems The value proposition of Linux – especially when it comes to its use in the enterprise – can be broken out into three perceived benefits: lower total cost of ownership (TCO), security, and feature set While numbers and comparison alone can contribute to measurement of TCO and feature set, security requires further qualification Expertise in the Linux platform is highly sought after across all industries for multiple disciplines, from system administration to big data analytics to incident response This means, from a practical perspective, most of a business’s focus remains on supporting and protecting Windows assets Linux remains a mystery to a number of enterprise IT specialists –most critically for network defenders Identifying and qualifying potential incidents requires a familiarity with what constitutes normal operation in order to isolate anomalies The same is true for any other asset in an environment, normal operation is entirely dependent on a given asset’s role / function in the enterprise Lack of expertise and visibility into non-Windows platforms combine in some environments to present significant risks against an organization’s security posture As a recent caution, the Linux vulnerability described under CVE-2016-0728 further demonstrates the potential breadth of real-world risks to associated platforms A natural extension of this exposure is increased targeting by both dedicated and opportunistic attackers across various malicious actor motivations Despite the lingering belief (and false sense of security) that Linux inherently yields higher degrees of protection from malicious actors, Linux malware and vulnerabilities do exist and are in use by advanced adversaries To mitigate associated risks requires tailored integration of the people, processes, and technology in support of prevention, monitoring, and detection within an environment
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Introduction The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments There have been numerous reports on their activities, to the extent that a Wikipedia entry has even been created for them The Linux malware Fysbis is a preferred tool of Sofacy, and though it is not particularly sophisticated, Linux security in general is still a maturing area, especially in regards to malware In short, it is entirely plausible that this tool has contributed to the success of associated attacks by this group This blog post focuses specifically on this Linux tool preferred by Sofacy and describes considerations and implications when it comes to Linux malware Malware Assessment Fysbis is a modular Linux trojan / backdoor that implements plug-in and controller modules as distinct classes For reference, some vendors categorize this malware under the Sednit attacker group naming designation This malware includes both 32-bit and 64-bit versions of Executable and Linking Format (ELF) binaries Additionally, Fysbis can install itself to a victim system with or without root privileges This increases the options available to an adversary when it comes to selecting accounts for installation They epitomize the grudging reality that Advanced Persistent Threat (APT) actors often don’t require advanced means to affect their objectives Rather, these actors more often than not hold their advanced malware and zero day exploits in reserve and employ just enough resources to meet their goals It is only fair that defenders use any shortcuts or tricks at their disposal to shorten the amount of time it takes to assess threats In other words, defenders should always look for ways to work smarter before they have to work harder Getting the Most Out of Strings Binary strings alone revealed a good amount about these files, increasing the efficacy of activities such as static analysis categorization (e.g., Yara) One example of this is Fysbis installation and platform targeting information for the samples in Table 1 and Table 2 Figure 1: Sofacy Fysbis installation and platform targeting found in strings In this case, we can see the binary installation path and local reconnaissance to determine which flavor of Linux the malware is running Another example of easily obtained information from these samples is capability based In addition to contributing to static analysis detections, this can be useful as a starting point for further incident response prioritization and qualification of the threat Symbolic Information Can Shorten Analysis Time Interestingly, the most recent ELF 64-bit binary we analyzed (Table 3) was not stripped prior to delivery, which offered additional context in the form of symbolic information Defenders more familiar with Windows Portable Executable (PE) binaries can equate this with compilation of a Debug version versus a Release version Additionally, this latest sample demonstrated minor evolution of the threat, most notably in terms of obfuscation Specifically, both samples in Table 1 and Table 2 leaked installation information in the clear within binary strings This was not the case with the sample in Table 3 Taking a closer look at this non-stripped binary using a disassembler, the following corresponds to decoding malware installation information for a root-privilege account Figure 5: Assembly code view of Sample 3 installation decoding In this case, the symbolic information hints at the method used for decoding, with references to mask, path, name, and info byte arrays Corresponding INSTALLUSER byte arrays exist, which facilitate the non-root installation for the trojan The same masking method is also used by the binary to decode malware configuration C2 information, further showcasing how a little symbolic information can go a long way towards completeness and higher confidence in assessment of a malware sample If you would like to learn more about how Fysbis works, the samples analyzed remain fairly consistent with the sample analysis found here Infrastructure Analysis As Unit 42 has discussed in depth in other blog articles, we have observed that adversaries in general are seemingly hesitant in changing their infrastructure This may be due to not wanting to commit additional resources, or simply a matter of retaining familiarity for the sake of timeliness In either case, we see the same type of behavior here with the Fysbis samples in use by Sofacy The oldest sample (Table 1), was found to beacon to the domain azureon-line[.]com, which had already been widely publicized as a known command and control domain for the Sofacy group Using passive DNS, we can see that two of the original IPs this domain resolved to, 193.169.244[.]190 and 111.90.148[.]148 also mapped to a number of other domains that had been in use by the Sofacy group during that time period Figure 7: Sample 1 C2 resolutions The first of the newer samples (Table 2), continues the trend and beacons to an IP also widely associated with the Sofacy group, 198.105.125[.]74 This IP has been mostly associated with the tool specifically known as CHOPSTICK, which can be read about here Figure 8: Sample 2 C2 resolutions The newest sample (Table 3), introduces a previously unknown command and control beacon to mozilla-plugins[.]com This activity aligns with the previously observed Sofacy group tactic of integrating legitimate company references into their infrastructure naming convention Comparing this sample’s binary with the other two however, shows there are significant similarities on the code level as well as in terms of shared behavior Figure 9: Sample 3 C2 resolutions Conclusion Linux is used across business and home environments and appears in a variety of form factors Linux is also at the foundation of Android devices and a number of other embedded systems The value proposition of Linux – especially when it comes to its use in the enterprise – can be broken out into three perceived benefits: lower total cost of ownership (TCO), security, and feature set While numbers and comparison alone can contribute to measurement of TCO and feature set, security requires further qualification Expertise in the Linux platform is highly sought after across all industries for multiple disciplines, from system administration to big data analytics to incident response This means, from a practical perspective, most of a business’s focus remains on supporting and protecting Windows assets Linux remains a mystery to a number of enterprise IT specialists –most critically for network defenders Identifying and qualifying potential incidents requires a familiarity with what constitutes normal operation in order to isolate anomalies The same is true for any other asset in an environment, normal operation is entirely dependent on a given asset’s role / function in the enterprise Lack of expertise and visibility into non-Windows platforms combine in some environments to present significant risks against an organization’s security posture As a recent caution, the Linux vulnerability described under CVE-2016-0728 further demonstrates the potential breadth of real-world risks to associated platforms A natural extension of this exposure is increased targeting by both dedicated and opportunistic attackers across various malicious actor motivations Despite the lingering belief (and false sense of security) that Linux inherently yields higher degrees of protection from malicious actors, Linux malware and vulnerabilities do exist and are in use by advanced adversaries To mitigate associated risks requires tailored integration of the people, processes, and technology in support of prevention, monitoring, and detection within an environment ### Response: .