Russian Hackers Shift Ways, Goal Extra Victims with Paid Malware

Russian hackers and APT teams are escalating cyberattacks, leveraging available malware and broadening their targets past governments. Flashpoint researchers reveal these evolving ways and learn how to shield your group.

Earlier this week, studies surfaced indicating that state-sponsored teams in Iran are collaborating for large-scale assaults, and comparable actions are occurring in Russia. Because the Ukraine-Russian Conflict continues, Russian Superior Persistent Risk (APT) teams are adapting their TTPs and malware, with many sharing supply methods and utilizing paid instruments as a substitute of customized payloads, revealed researchers at Flashpoint of their newest report.

The researchers have found a dangerously fast-paced sophistication of their Ways, Methods, and Procedures (TTPs) in current spear-phishing campaigns and a choice for malware available on unlawful on-line marketplaces, making them more durable to detect.

Whereas historically concentrating on authorities and political entities, these teams at the moment are setting their sights on a wider vary of victims. The motivations behind these assaults can fluctuate, from espionage and intelligence gathering to monetary acquire. 

Flashpoint analysts reviewed campaigns by a number of Russian APT teams in 2024, together with APT28, APT29, Gamaredon, Gossamer Bear, UAC-0050, and UAC-0149. Right here’s a quick overview of their actions.

APT28 impersonates authorities organizations in lots of nations, together with Belarus, Poland, and the USA, utilizing free internet hosting suppliers to host backdoors concentrating on Home windows programs. APT29 makes use of droppers and downloaders, together with BURNTBATTER, DONUT, and Wineloader whereas APT44-associated hackers largely goal investigative journalists.

Gamaredon, probably the most energetic group within the Russia-Ukraine conflict, makes use of malicious paperwork and malware. Gossamer Bear targets Ukraine and NATO nations, whereas UAC-0050 targets Ukrainian and Polish authorities organizations. UAC-0149 made headlines in February 2024 after it launched phishing makes an attempt by way of Sign Messenger.

Researchers additionally explored Russian APTs killchain, discovering that they primarily depend on HTML-based droppers, comparable to ROOTSAW and WINELOADER, to execute malicious code. As well as, they use infostealers, commodity malware, or use compromised web sites for command and management. NTLM hash stealing is one other technique continuously utilized by Russian APT teams.

In its report, Flashpoint identified many infamous campaigns from Russian APTs highlighting their evolving TTPs. For example, in a 2023 marketing campaign, APT29 used a staggering six distinctive loaders in spear-phishing makes an attempt. Agent Tesla, Remcos, Smokeloader, Snake Keylogger, and Guloader had been the most typical malware households utilized in spear-phishing campaigns.

Organizations can shield themselves by reviewing irregular little one processes of HTML and.HTA recordsdata, detecting downloads at internet proxy, implementing DLL side-loading detections, and reviewing community logs for mock API companies.

RELATED TOPICS

1. Microsoft Executives’ Emails Breached by Russia Hackers
2. Russian Midnight Blizzard Breached Microsoft Supply Code
3. Russian APT28 Abuse Home windows Vulnerability with GooseEgg Device
4. Russian Hackers Goal Ubiquiti Routers for Knowledge, Botnet Creation
5. Russian Hackers Hit Mail Servers in Europe for Political, Army Intel