Kaspersky Lab researchers have observed that the Russian-speaking threat actor Sofacy, also known as APT28 or Fancy Bear is shifting its target to the Far East, with a strong interest in military, defense and diplomatic organisations – in addition to its traditional NATO-related targets.
The researchers discovered that Sofacy sometimes overlaps with other threat actors when targeting victims, including with the Russian-speaking Turla and the Chinese-speaking Danti, Most intriguingly of all, they found Sofacy backdoors on a server previously compromised by the English-language threat actor behind the Lamberts. The server belongs to a military and aerospace conglomerate in China.
Sofacy is a highly active and prolific cyberespionage group that Kaspersky Lab’s researchers have been tracking for many years. In February, Kaspersky Lab published an overview of Sofacy’s activities in 2017, revealing a gradual move away from NATO-related targets towards the Middle East, Central Asia, and beyond.
Sofacy uses spear-phishing and sometimes water-holing to steal information, including account credentials, sensitive communications and documents. It is also suspected of delivering destructive payloads to various targets.
The new findings show that Sofacy is not the only predator stalking these regions, and that this sometimes results in a target overlap between very different threat actors. In the case of Sofacy, researchers found scenarios where its Zebrocy malware competed for victim access with Russian-speaking Mosquito Turla clusters; and where its SPLM backdoor competed with traditional Turla and Chinese-speaking Danti attacks. The shared targets included government administration, technology, science and military-related organisations in or from Central Asia.
In some cases, targets appeared to be subjected simultaneously to separate attacks from both SPLM and Zebrocy. However, the most intriguing overlap is probably that between Sofacy and the English-speaking threat actor behind the Lamberts. The connection was discovered after researchers detected the presence of Sofacy on a server that threat intelligence had previously identified as compromised by Grey Lambert malware. The server belongs to a Chinese conglomerate that designs and manufactures aerospace and air defense technologies.
However, in this example the original SPLM delivery vector for Sofacy remains unknown. That raises a number of hypothetical possibilities, including the fact that Sofacy could be using a new and as yet undetected exploit or a new strain of its backdoor; or that Sofacy had somehow managed to harness Grey Lambert’s communication channels to download its malware. It could even mean that the Sofacy indicators could be a false flag, planted by the previous Lambert presence. Researchers believe the most likely answer is that an unknown new PowerShell script or legitimate but vulnerable web app was exploited to load and execute the SPLM code in this instance. Research is ongoing.
“Sofacy is sometimes portrayed as wild and reckless, but as seen under our visibility, the group can be pragmatic, measured, and agile,” says Kurt Baumgartner, principal security researcher at Kaspersky Lab. “Their activity in the East has been largely under-reported, but they are clearly not the only threat actor interested in this region, or even in the same targets. As the threat landscape grows ever more crowded and complex, we may encounter more examples of target overlap – and it could explain why many threat actors check victim systems for the presence of other intruders before fully launching their attacks.”
Researchers also found that Sofacy now maintains distinct subdivisions for each of its main tools, with clusters for the coding, development and targeting of SPLM (also known as CHOPSTICK and Xagent), GAMEFISH, and Zebrocy. SPLM is considered to be Sofacy’s primary and most selective second stage tool, while Zebrocy is used for high volume attacks. According to researchers, in early 2018 Sofacy targeted large air-defense related commercial organisations in China with SPLM, while deploying Zebrocy more widely across Armenia, Turkey, Kazahkstan, Tajikistan, Afghanistan, Mongolia, China, and Japan.